Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1698932113284.pdf (New Zealand)
Privacy Bill Government Bill Explanatory note General policy statement The Privacy Bill (the Bill) repeals and replaces the Privacy Act 1993 (the Act), as recommended by Law Commission’s 2011 review of the Act.

The Act has been in operation for 25 years.

Over that time, the rise of the Internet and the digital economy has transformed business and government, and the use of person- al information.
New technologies such as social media platforms, e-commerce, Inter- net-connected devices, and cloud storage have changed the way personal information is used.

Large quantities of data are readily stored, retrieved, and disclosed and can be easily sent around the world.

This creates many benefits, but also new challenges for the protection of personal information.

The Law Commission has called for the Act to be updated and modernised to reflect these changes.
Like the Act, the Bill regulates the collection, use, and disclosure of information about individuals.

The Bill retains the Act’s 12 information privacy principles, which seek to protect people’s privacy, while also accommodating legitimate information use by government, firms, and other organisations.

Information privacy principles 6 and 7, for example, continue to provide, respectively, for a person’s right to access and correct information about them.
The Bill also updates the information privacy principles in some respects, for example, to better protect personal information sent overseas.

The Bill retains the Act’s complaints system.

If a person thinks his or her privacy has been breached resulting in harm, he or she can complain to the Privacy Commis- sioner.

The Privacy Commissioner will then attempt to resolve the dispute.

If it is not resolved, the person may take the complaint to the Human Rights Review Tribunal and may seek compensation.
34—1 2 Privacy Bill Explanatory note The Bill introduces additional ways, however, to enforce the information privacy principles.

For example, the Privacy Commissioner will be able to make binding deci- sions on complaints about access to information and issue compliance notices.
The Bill also requires agencies (the name used for any entity handling personal informa- tion) to notify the Privacy Commissioner and affected individuals of any unauthorised access to or disclosure of personal information where that poses a risk of harm.

Purpose of the reforms The key purpose of reforming the Act is to promote people’s confidence that their personal information is secure and will be treated properly.
The Bill achieves this pur- pose through reforms that will help address privacy risks earlier and give the Privacy Commissioner a stronger role.

Public confidence in the way personal information is used and handled will, in turn, support the innovative and effective use of personal information by public and private sector agencies.
Changes made in the Bill The Bill implements most of the Law Commission’s recommendations, and some rec- ommendations from the Privacy Commissioner’s Necessary and Desirable reports.
The key changes are listed below— • • • • • • mandatory reporting of privacy breaches: privacy breaches (unauthorised or accidental access to, or disclosure of, personal information) that pose a risk of harm to people must be notified to the Privacy Commissioner and to affected individuals: compliance notices: the Commissioner will be able to issue compliance notices that require an agency to do something, or stop doing something, in order to comply with privacy law.
The Human Rights Review Tribunal will be able to enforce compliance notices and hear appeals: strengthening cross-border data flow protections: New Zealand agencies will be required to take reasonable steps to ensure that personal information dis- closed overseas will be subject to acceptable privacy standards.
The Bill also clarifies the application of our law when a New Zealand agency engages an overseas service provider: new criminal offences: it will be an offence to mislead an agency in a way that affects someone else’s information and to knowingly destroy documents con- taining personal information where a request has been made for it.
The penalty is a fine not exceeding $10,000: Commissioner making binding decisions on access requests: this reform will enable the Commissioner to make decisions on complaints relating to access to information, rather than the Human Rights Review Tribunal.
The Commission- er’s decisions will be able to be appealed to the Tribunal: strengthening the Privacy Commissioner’s information gathering power: the Commissioner’s existing investigation power is strengthened by allowing him Explanatory note Privacy Bill 3 or her to shorten the time frame within which an agency must comply, and in- creasing the penalty for non-compliance.
The changes will better align New Zealand’s privacy law with international develop- ments, such as the 2013 OECD Privacy Guidelines and the European Union’s forth- coming General Data Protection Regulation.

The Bill modernises and updates the language used in the Act to make the Bill easier to navigate and read.

It also makes minor and technical changes.


For example, it ad- dresses 2 problems that have emerged with Approved Information Sharing Agree- ments (AISAs), namely making it easier for an AISA to apply to a class of agencies, and allowing specified Crown agents to lead an AISA’s development.

The Bill updates authorisations for sharing listed law enforcement information, in- cluding some court information.
It clarifies the relationship between privacy legis- lation and the Senior Courts Act 2016 and the District Court Act 2016.

It also re-es- tablishes the ability to amend authorisations by Order in Council, where the proposed change does not involve sharing court information.

The Bill preserves existing Infor- mation Matching Agreements but, in the future, information matching programmes will be able to be authorised using AISAs.
Departmental disclosure statement The Ministry of Justice is required to prepare a disclosure statement to assist with the scrutiny of this Bill.

The disclosure statement provides access to information about the policy development of the Bill and identifies any significant or unusual legislative features of the Bill.

A copy of the statement can be found at http://legislation.govt.nz/disclosure.aspx?
type=bill&subtype=government&year=2018&no=34 Regulatory impact assessment The Ministry of Justice produced regulatory impact assessments in March 2012 and August 2014 to help inform the main policy decisions taken by the Government relat- ing to the contents of this Bill.
Copies of these regulatory impact assessments can be found at— • • https://www.justice.govt.nz/justice-sector-policy/constitutional-issues-and- human-rights/regulatory-impact-statements/ http://www.treasury.govt.nz/publications/informationreleases/ris Clause 1 states the Bill’s Title.

Clause by clause analysis Clause 2 is the commencement clause and states that the Bill comes into force on 1 July 2019.
As the Bill is intended to come into force 6 months after enactment, this date may need to be updated during the legislative passage of the Bill.

4 Privacy Bill Explanatory note Part 1 Preliminary provisions Subpart 1—Preliminary matters Clause 3 states the purpose of the Bill.

Clause 4 gives effect to the transitional, savings, and related provisions in Schedule 1.

Clause 5 states that the Bill binds the Crown.

Subpart 2—Interpretation and related matters Clause 6 defines terms used in the Bill.
Key terms include agency, information priva- cy principle (IPP), personal information, and public register privacy principle (PRPP).

Terms used in the Bill have substantially the same definitions as in the Pri- vacy Act 1993, which this Bill replaces.
However, 3 notable changes are— • • • the definition of collect is amended to clarify that, in relation to personal infor- mation, collect requires taking a step to seek or obtain the personal informa- tion, and so would include attempting to obtain information: the definition of publicly available publication is amended to clarify that it in- cludes an electronic publication, that a publication can be publicly available even if a fee is charged for access, and that a publicly available publication in- cludes a register maintained under an enactment to the extent that that register may be accessed by members of the public: the definition of unique identifier is replaced to clarify that, in relation to an individual, it means an identifier other than the individual’s name that uniquely identifies the individual.
Clause 7 re-enacts section 3(1) to (3) of the Privacy Act 1993 and sets out the circum- stances in which information is to be treated as being held by an agency.

Clause 8 re-enacts section 3(4) of the Privacy Act 1993, but clarifies that when per- sonal information held by an agency is treated as being held by another agency, it does not matter that the holder agency is outside New Zealand or holds the informa- tion outside New Zealand.
Clause 9 re-enacts section 4 of the Privacy Act 1993 and provides that agencies are responsible for the actions of, or information disclosed to, their employees.

Part 2 Privacy Commissioner Subpart 1—Appointment of Privacy Commissioner Clause 10 continues the office of the Privacy Commissioner.

As provided in section 12 of the Privacy Act 1993, the Commissioner is a corporation sole and a Crown enti- ty for the purposes of the Crown Entities Act 2004.
Explanatory note Privacy Bill 5 Clause 11 re-enacts section 15 of the Privacy Act 1993 and provides for the appoint- ment of a Deputy Privacy Commissioner.

Clause 12 re-enacts section 19 of the Privacy Act 1993 and prohibits the Commis- sioner from holding other offices.

Clause 13 re-enacts clause 4 of Schedule 1 of the Privacy Act 1993 and relates to superannuation and retiring allowances for the Commissioner and Deputy Commis- sioner.
Subpart 2—Functions of Privacy Commissioner Clause 14 re-enacts section 13(1) and (2) of the Privacy Act 1993 and sets out in a more consolidated format the Commissioner’s functions.

There is no change to the Commissioner’s functions, except that the Commissioner will no longer be required to publish directories of personal information (as section 21 of the Privacy Act 1993 is not carried over into the Bill).
Clause 15 re-enacts section 26(1) of the Privacy Act 1993 and requires the Commis- sioner to monitor the operation of the Privacy Act and provide a report to the respon- sible Minister.

Clause 16 re-enacts section 26(2) of the Privacy Act 1993 and requires that a copy of any report received by the responsible Minister under clause 15 be presented to the House of Representatives.

Clause 17 re-enacts section 13(1A) of the Privacy Act 1993 and requires the Com- missioner to act independently.
Clause 18 re-enacts section 14 of the Privacy Act 1993 and sets out the matters that the Commissioner must have regard to, or take account of, when performing his or her functions, or exercising his or her powers.
Part 3 Information privacy principles, public register privacy principles, and codes of practice Subpart 1—Information privacy principles Clause 19 re-enacts the 12 information privacy principles (IPPs) set out in section 6 of the Privacy Act 1993 with the following changes: • • IPP 2 has an additional exception that enables an agency to collect personal in- formation from a source other than the individual concerned if the agency be- lieves, on reasonable grounds, that it is necessary to collect the information from that source to prevent or lessen a serious threat to the life or health of any individual: IPP 3 no longer has the existing exception that permits an agency to collect personal information from the individual concerned without ensuring the indi- 6 • • • • Privacy Bill Explanatory note vidual is aware of specified matters if the collection is authorised by the indi- vidual: IPP 4 now requires an agency to have particular regard to the age of the indi- vidual concerned to ensure the means by which personal information is collec- ted is fair and does not intrude to an unreasonable extent upon the affairs of that individual: IPP 7 is changed with the procedural provisions of existing IPP 7(3) and (5) being moved to Part 4: IPP 11 is changed in 2 respects.
First, there is a new subclause (2), clarifying that an agency may rely on the exception in IPP 11(1)(e)(i) (the maintenance of the law exception) to report any reasonably held belief that an offence has been, or may be, committed.

Secondly, a more substantive change is made by the inclusion of new subclauses (3) to (6).

These new provisions impose addi- tional obligations on agencies when disclosing personal information to an over- seas person to ensure the protection of that information.
Disclosure to an over- seas person will generally only be permissible if— • • • the individual concerned consents to the disclosure of his or her informa- tion to the overseas person; or the overseas person is in a country that is prescribed in regulations as having privacy laws comparable to New Zealand; or the agency believes that the overseas person is required to protect the in- formation in a way that, overall, is comparable to the protections affor- ded by our New Zealand legislation.
IPP 12 is amended to clarify that an agency that simply records a unique iden- tifier assigned by another agency in order to contact that other agency and enable that other agency to locate its records is not assigning the unique identi- fier for use in its own operations.

IPP 12 is also amended to include another exception that permits agencies to use unique identifiers for statistical and re- search purposes.
The third amendment to IPP 12 is to require that, before dis- closing a unique identifier, an agency must take all reasonable steps to mini- mise the risk of misuse of that identifier.

Clause 20 re-enacts section 10 of the Privacy Act 1993 and provides, for the purposes of IPP 5 and IPPs 8 to 11, that personal information held by an agency includes infor- mation held by that agency outside New Zealand if that information has been transfer- red out of New Zealand.
For the purposes of IPPs 6 and 7 all personal information held outside New Zealand is covered, whether or not it was transferred outside New Zealand.

Clause 21 re-enacts section 60(1) of the Privacy Act 1993 and requires that an agency administering a public register must comply, so far as is reasonably practicable with the IPPs.

Clause 22 re-enacts section 7 of the Privacy Act 1993, expressing more simply the relationship between the IPPs and other law.
Explanatory note Privacy Bill 7 Clause 23 re-enacts section 8(1) and (5) of the Privacy Act 1993, providing that IPPs 1 to 4 apply only to personal information collected after 2 July 1993, and that IPP 12(1) to (4) applies only to the assignment of unique identifiers after 2 July 1993.

It also clarifies that an agency cannot, after that date, assign to an individual a unique identifier previously assigned to that individual, whether the previous assignment was before or after 2 July 1993.
Clause 24 re-enacts section 56 of the Privacy Act 1993 and exempts from the applica- tion of certain IPPs personal information relating to personal or domestic affairs.

However, 2 changes are made.

The exemption does not apply if the information is being or has been collected by an unlawful means, or by engaging in misleading or deceptive conduct.

It also does not apply if the collection, use, or disclosure of the information would be highly offensive to a reasonable person.
Clause 25 re-enacts section 57 of the Privacy Act 1993 and carries over the existing exemption for the intelligence and security agencies.

Clause 26 re-enacts and consolidates sections 7(5) and 55 of the Privacy Act 1993, which exempt the application of the access and correction principles from 6 classes of information, including information collected by Statistics New Zealand under the Sta- tistics Act 1975.
Clause 27 re-enacts section 54 of the Privacy Act 1993, which empowers the Com- missioner to authorise the collection, use, or disclosure of personal information which would otherwise breach IPP 2, 10, or 11.

The scope of this provision is, however, ex- tended to empower the Commissioner to also authorise the keeping of personal infor- mation in breach of IPP 9.
The application procedure for an authorisation is set out, and requires the applicant to give notice of the application to all individuals con- cerned and to provide those individuals sufficient opportunity to object.

A list of cur- rent authorisations granted under this provision must be kept on the Commissioner’s Internet site.
Clause 28 re-enacts section 11 of the Privacy Act 1993 and provides that if a public sector agency holds personal information, the individual concerned has a legal right to access that information under IPP 6, and that right may be enforced by a court order.

The IPPs do not otherwise confer any legal rights enforceable in a court.
Subpart 2—Public register privacy principles Clauses 29 to 34 re-enact, with technical changes only, sections 58, 59, 60, 62, and 65 of the Privacy Act 1993 relating to public register privacy principles.
Subpart 3—Codes of practice Clauses 35 to 43 re-enact sections 46 to 53 and 63 to 64 of the Privacy Act 1993, relating to the issue of codes of practice, with the following changes: • a code of practice cannot now be issued containing all of the IPPs without any modification: 8 • • • Privacy Bill Explanatory note providing for the issue of sector-specific codes of practice applying 1 or more of the IPPs to information about deceased persons: requiring the Commissioner to ensure that a code of practice is publicly avail- able on an Internet site: clarify that the failure to comply with a code of practice issued in relation to public registers modifying the application of 1 or more IPP is to be treated as breaching an IPP.
Part 4 Access to and correction of personal information Part 4 re-enacts Parts 4 and 5 of the Privacy Act 1993, re-organising the provisions into a more logical and accessible structure that is divided into 3 subparts.

Subpart 1—Access to personal information Clause 44 defines access request and requestor.
An access request is a request made under IPP 6(1)(a) (request for confirmation whether an agency holds personal infor- mation about the requestor) or IPP 6(1)(b) (request for access to the requestor’s per- sonal information), or both.

Clause 45 re-enacts section 34 of the Privacy Act 1993 and provides that only indi- viduals (natural persons) may make an access request.
Clause 46 re-enacts section 37 of the Privacy Act 1993 and provides that a requestor can ask that his or her access request be treated as urgent, giving the reason for the urgency.

The obligation of an agency on receipt of an urgent request is clarified.

The agency must consider the request, and the reason for the request, when determining the priority to be given to responding to it.
Clause 47 re-enacts section 38 of the Privacy Act 1993 and requires an agency to give reasonable assistance to an individual who wishes to make an access request, or who is making an access request.

Clause 48 re-enacts section 39 of the Privacy Act 1993 and provides for the transfer of access requests.

However, an agency is not now be required to transfer a request if the agency has good cause to believe that the requestor does not want his or her re- quest transferred.
If an agency, does not transfer a request in reliance on this belief the agency must, within 10 working days, inform the requestor and supply the name of the agency to which the request could be transferred.

Clause 49 sets out the procedure that an agency must follow on receipt of a request made under IPP 6(1)(a).

There is no change to the current procedural requirements, which are now consolidated in this clause.
Clause 50 sets out the procedure that an agency must follow on receipt of a request made under IPP 6(1)(b).

There is no change to the current procedural requirements, which are now consolidated in this clause.

Explanatory note Privacy Bill 9 Clause 51 re-enacts section 41 of the Privacy Act 1993 and enables an agency to ex- tend the time limit for transferring or deciding whether to grant an access request.
The circumstances for extending a time limit now also include if the processing of the re- quest raises complex issues.

Clause 52 groups together the reasons that an agency may give for refusing an access request made under IPP 6(1)(b) that are related to the safety of the requestor.
In add- ition to the existing reasons in sections 27(1)(d) and 29(1)(c), (d), (e) and (4) of the Privacy Act 1993, 2 further reasons are included for refusing access to information requested— • • the disclosure of the information would create a significant likelihood of ser- ious harassment of an individual: the disclosure of the information would involve the disclosure of information about another individual who is the victim of an offence or alleged offence and would cause that person significant distress, loss of dignity, or injury to feel- ings.
In any case where an agency is proposing to refuse an access request because disclos- ure of the information would be likely to prejudice the physical or mental health of the requestor, the agency may consult with the requestor’s health practitioner (and is not limited to consulting with the requestor’s medical practitioner as currently).
Clause 53 re-enacts section 29(1)(b) and (3) of the Privacy Act 1993 and sets out when an agency may refuse an access request made under IPP 6(1)(b) if the informa- tion requested is evaluative material.

An agency may now also refuse to disclose eval- uative material if that material was made available to the agency by another agency and that other agency has grounds for refusing to disclose the material.
It is also clari- fied that evaluative or opinion material provided by a person within the agency as part of his or her job is not evaluative material for the purposes of this provision.

Clause 54 re-enacts section 27 of the Privacy Act 1993 and sets out when an agency may refuse an access request made under IPP 6(1)(b) for reasons related to the secur- ity and defence of New Zealand or prejudice to international relations.
Clause 55 re-enacts section 28 of the Privacy Act 1993 and provides that an agency may refuse an access request made under IPP 6(1)(b) if making the information avail- able would disclose a trade secret.

Clause 56 re-enacts section 29(2) of the Privacy Act 1993 and provides that an agency may refuse an access request made under IPP 6(1)(b) if the information re- quested is not readily available, doesn’t exist, cannot be found, or is not held by the agency.
Clause 57 groups together all the other reasons that an agency may give for refusing an access request made under IPP 6(1)(b).

In addition to the existing grounds in sec- tions 27(1)(c), 29(1)(a) and (f) to (j) of the Privacy Act 1993, an agency may also re- fuse an access request if the agency has reasonable grounds for believing that the re- quest was made under duress.
10 Privacy Bill Explanatory note Clause 58 expressly provides that instead of refusing an access request made under IPP 6(1)(b), an agency may grant access but impose conditions relating to the reques- tor’s use of the information or the requestor’s disclosure of the information, or both.
Clause 59 re-enacts section 44 of the Privacy Act 1993 and specifies the matters a requestor must be informed of if an agency responds to an access request made under IPP 6(1)(a) or (b) by neither confirming nor denying that it holds information about the requestor.

Clause 60 re-enacts section 44 of the Privacy Act 1993 and specifies the matters a requestor must be informed of if an agency refuses an access request made under IPP 6(1)(b).
If the reason for refusing the request is that the information is evaluative ma- terial, the grounds in support of that reason must be disclosed to the requestor auto- matically, unless the giving of those grounds would be prejudicial to the interest pro- tected.
Clause 61 re-enacts section 43 of the Privacy Act 1993 and provides that if there is good reason for withholding some of the information in a document, the other infor- mation in that document may be made available by releasing a copy of the document with deletions and alterations.

In relation to the information that is withheld, the agency has the same obligations as specified in clause 60.
Clause 62 re-enacts section 42 of the Privacy Act 1993 and sets out the ways infor- mation may be made available to a requestor.

An agency must make the information available in the way preferred by the requestor unless to do so would impair adminis- trative efficiency or be contrary to a legal duty.

Clause 63 re-enacts section 45 of the Privacy Act 1993 and sets out the responsibil- ities of an agency before giving access to information.
Subpart 2—Correction of personal information Clause 64 defines correction request and requestor.

A correction request is a request made under IPP 7(1)(a) (request to correct information) or IPP 7(2)(b) (request that a statement of correction be attached to the information).

Clause 65 re-enacts section 34 of the Privacy Act 1993 and provides that only indi- viduals (natural persons) may make correction requests.
Clause 66 re-enacts section 37 of the Privacy Act 1993 and provides that a requestor can ask that his or her request be treated as urgent, giving the reason for the urgency.

The obligation of an agency on receipt of an urgent request is clarified.

The agency must consider the request, and reason for the request, when determining the priority to be given to responding to it.
Clause 67 re-enacts section 38 of the Privacy Act 1993 and requires an agency to give reasonable assistance to an individual who wishes to make a correction request, or who is making a correction request.

Clause 68 re-enacts section 39 of the Privacy Act 1993 and provides for the transfer of a correction request.

Explanatory note Privacy Bill 11 Clause 69 sets out the procedure that an agency must follow on receipt of a request made under IPP 7(1)(a).
The matters that must be notified to a requestor are speci- fied.

If a request is not granted, the requestor must be informed of the reason, that he or she may provide a statement of correction with a request under IPP 7(2)(b), and of his or her right to make a complaint to the Commissioner.

Clause 70 sets out the procedure that an agency must follow on receipt of a request made under IPP 7(2)(b).
If an agency takes no steps to attach a statement of correc- tion as requested, the agency must inform the requestor.

Clause 71 re-enacts section 41 of the Privacy Act 1993 and enables an agency to ex- tend the time limit for transferring or deciding whether to grant a correction required.
Subpart 3—Charges Clause 72 re-enacts sections 35(1) to (5) and 40(2) of the Privacy Act 1993 and more clearly sets out the charges that may be imposed by a public sector agency (if author- ised by the Commissioner) and a private sector agency.

A public sector agency may not now be authorised by the Commissioner to charge for correcting information in accordance with a request made under IPP 7(1)(a).
Clause 73 re-enacts section 73 of the Privacy Act 1993, which provides for the Com- missioner to authorise a public sector agency to impose a charge for granting an ac- cess request and for attaching a statement of correction to personal information.
Part 5 Complaints, investigations, and proceedings Part 5 re-enacts Parts 8 and 9 of the Privacy Act 1993 and sets out the procedures for making, investigating, and resolving complaints, or investigating and resolving mat- ters that the Commissioner considers are an interference with the privacy of an indi- vidual.

New Part 5 essentially carries over the existing procedures but more clearly identifies the types of complaints that may be made and the resolution pathway for each type of complaint.
However, there are 2 substantive changes— • • if the Commissioner determines that a complaint about an agency refusing to make personal information available has substance, the Commissioner may di- rect the agency to make the information available.
The complaint need not be referred to the Human Rights Review Tribunal as at present, although an agency may appeal to the Tribunal against the Commissioner’s direction: the Commissioner may now impose a time limit for a person to provide infor- mation, documents, or things within that person’s possession or control that the Commissioner considers may be relevant to an investigation.

If no time limit is imposed by the Commissioner, the current default period of 20 working days applies.
Any extension of the time limit is now at the discretion of the Com- missioner.

12 Privacy Bill Explanatory note Clause 74 defines terms used in new Part 5, including aggrieved individual and com- plainant.

Clause 75 re-enacts section 66 of the Privacy Act 1993 and sets out the circumstances in which an action is an interference with the privacy of an individual.
These circum- stances now include a refusal of a request that a statement of correction be attached to personal information, a failure to meet time limits in relation to correction requests, and undue delay in correcting information after granting a request.

The term interfer- ence with the privacy of an individual is key to Part 5.
Clause 76 specifies the 2 types of complaint that may be made— Subpart 1—Complaints • • a complaint alleging that an action of an agency is, or appears to be, an interfer- ence with the privacy of an individual: a public register complaint.

Clause 77 re-enacts section 67(1) of the Privacy Act 1993 and expressly provides that a complaint may be made by an aggrieved individual.

A complaint may now also be bought by a representative of 1 or more aggrieved individuals.
Clause 78 re-enacts sections 67(2) and 68 of the Privacy Act 1993 and provides that a complaint must be made to the Commissioner, and may be made orally or in writing.

An oral complaint must be put in writing as soon as practicable.

Clause 79 re-enacts sections 70, 71(3), 72(3), 72A(3), 72B(3) and 72C(3) of the Pri- vacy Act 1993.

These provisions are drawn together to set out the 6 options available to the Commissioner on receiving a complaint.
Clause 80 re-enacts section 71(1) of the Privacy Act 1993 and sets out the circum- stances in which the Commissioner may decide not to investigate a complaint.
These circumstances are expanded to include— • • • the complainant has not made reasonable efforts to resolve the complaint with the agency concerned: there is an alternative dispute resolution process available to the complainant: the complainant knew about the action that is the subject of the complaint for 12 months or more before making the complaint.
Clause 81 provides that the Commissioner may decide to defer taking action on the complaint if— • • the complainant has not complained to the agency concerned; and the Commissioner considers the complainant should do so in an attempt to di- rectly resolve the complaint.
Clause 82 re-enacts sections 72, 72A, and 72B of the Privacy Act 1993 and provides for the Commissioner to refer a complaint to an Ombudsman, the Health and Disabili- ty Commissioner, the Inspector-General of Intelligence and Security, or the Independ- ent Police Conduct Authority.

The Commissioner may only make a referral if the Explanatory note Privacy Bill 13 complaint relates to a matter more properly within the jurisdiction of one of those people.
Clause 83 re-enacts section 72C of the Privacy Act 1993 and enables the Commis- sioner to refer a complaint to an overseas privacy enforcement authority if the com- plaint relates to a matter that is more properly within the jurisdiction of that authority.

Clause 84 re-enacts sections 74 and 77(2)(c) of the Privacy Act 1993 and enables the Commissioner, before investigating a complaint, to explore the possibility of settle- ment.
If appropriate, the Commissioner may also endeavour to secure a satisfactory assurance from the agency whose action is the subject of the complaint that there will not be a repetition of that action.

Subpart 2—Investigations by Commissioner Clause 85 provides that subpart 2 of Part 5 applies to investigations conducted by the Commissioner— • • on complaints; or on his or her own initiative, in relation to any matter in respect of which a com- plaint may be made.
Clause 86 re-enacts section 73 of the Privacy Act 1993 and provides that, as the first step of an investigation, the Commissioner must notify the aggrieved individual and the respondent that an investigation is being commenced.

Clause 87 re-enacts section 74 and 77(1) and (2) of the Privacy Act 1993 and enables the Commissioner, at any time during an investigation, to explore the possibility of securing a settlement and a satisfactory assurance.
Clause 88 re-enacts sections 71(2), 75, 90(1) and (2) of the Privacy Act 1993, draw- ing together the provisions relating to the procedure for conducting an investigation.

Clause 89 re-enacts section 90(3) of the Privacy Act 1993 and provides that when conducting an investigation the Commissioner may regulate his or her own proced- ure.
Clause 90 re-enacts section 76 of the Privacy Act 1993 and provides that at any time during an investigation the Commissioner may call a conference of the parties to identify the matters in issue and to try to obtain a resolution of those issues.

Clause 91 re-enacts section 91 of the Privacy Act 1993 and gives the Commissioner power to summon and examine on oath any person who the Commissioner thinks has information relevant to the investigation.
Clause 92 re-enacts sections 92 and 93 of the Privacy Act 1993 and gives the Com- missioner power to require any person to provide any information, documents, or things in that person’s possession or under that person’s control the Commissioner considers may be relevant to an investigation.

The Commissioner will be able to spe- cify any date by which the person must comply, otherwise the default period of 20 working days applies.
Any extension of the time limit is at the discretion of the Com- missioner, not at the discretion of the agency as currently.

14 Privacy Bill Explanatory note Clause 93 re-enacts section 95 of the Privacy Act 1993 and provides that the Com- missioner may exercise his or her powers in clauses 91 and 92 in respect of a person even though compliance by that person would breach an obligation of secrecy or non- disclosure.
Clause 94 re-enacts section 94 of the Privacy Act 1993 and provides for the protec- tion and privileges of persons required to give evidence or provide information, docu- ments, or things to the Commissioner.

Clause 95 re-enacts section 96 of the Privacy Act 1993 and provides that any infor- mation, document, or thing provided to the Commissioner is privileged.
Clause 96 details the procedure to be followed after the Commissioner has completed an investigation of an action under subpart 1 of Part 4 (access to personal informa- tion) that appears to be an interference with the privacy of an individual.
As an alter- native to referring a complaint or matter to the Director, the Commissioner may now direct an agency to confirm whether it holds any specified information, or to permit the complainant access to specified information, or to make specified information available to the complainant in a particular way.
Clause 97 re-enacts section 75 and 78 of the Privacy Act 1993 and details the proced- ure to be followed after the Commissioner has completed an investigation of an ac- tion of an agency under subpart 3 of Part 4 (charges relating to access or correction requests) that appears to be an interference with the privacy of an individual.

There is no change to the current procedure that enables the Commissioner to make a deter- mination as to the appropriate charge which is final and binding on both parties.
Clause 98 re-enacts section 61 of the Privacy Act 1993 and details the procedure to be followed after the Commissioner has completed an investigation of a public regis- ter complaint.

Clause 99 re-enacts sections 75 and 77(1) and (2) of the Privacy Act 1993 and sets out the procedure to be followed after the Commissioner has completed any other in- vestigation.
Clause 100 re-enacts section 81 of the Privacy Act 1993 and sets out the special pro- cedure to be followed after completing an investigation relating to the action of an intelligence and security agency.

Clause 101 re-enacts section 80 of the Privacy Act 1993 and provides that the Com- missioner may report any significant breach of duty or misconduct on the part of an agency to an appropriate authority.
Subpart 3—Proceedings before Human Rights Review Tribunal Proceedings in relation to complaints or investigations Clause 102 re-enacts section 82 of the Privacy Act 1993 and affords to the Director of Human Rights Proceedings a discretion to commence proceedings in the Human Rights Review Tribunal in respect of a complaint or matter referred to him or her by the Commissioner.
Explanatory note Privacy Bill 15 Clause 103 re-enacts section 83 of the Privacy Act 1993 and sets out the circum- stances in which an aggrieved individual may commence proceedings in the Tribunal in respect of a complaint or matter.
These circumstances now include— • • if the Commissioner determines that a complaint has substance, or that a matter should be proceeded with, but does not refer the complaint or matter to the Director: if the Commissioner makes a direction that an agency provide access to person- al information, but the aggrieved individual is not satisfied with the terms of that direction.

The time frames for commencing a proceeding are specified.
Clause 104 re-enacts section 86 of the Privacy Act 1993 and provides that the Director may appear and be heard in any proceedings commenced in the Tribunal by an aggrieved individual under clause 103.

Clause 105 is a new provision and provides that an apology given by an agency is not admissible as evidence in any civil proceedings against the agency under Part 5, ex- cept for the purpose of assessing remedies to be awarded against the agency.
Clause 106 re-enacts section 87 of the Privacy Act 1993 and provides that the defend- ant has the onus of proving that an action is excepted or exempted from being an interference with the privacy of an individual.

Clause 107 re-enacts section 85(1) and (4) of the Privacy Act 1993 and sets out the remedies that the Tribunal may grant if it finds, on the balance of probabilities, that an action is an interference with the privacy of an individual.
Clause 108 re-enacts section 88 of the Privacy Act 1993 and provides that the Tribu- nal may award damages for an interference with the privacy of an individual in re- spect of— • • • pecuniary loss: loss of any benefit: humiliation, loss of dignity, and injury to feelings.

Access orders Clause 109 is a new provision that enables an aggrieved individual to apply to the Tribunal for an access order requiring an agency to comply with a direction made by the Commissioner under clause 96(5)(a).
Appeals against direction made after investigation of IPP 6 breach Clause 110 is a new provision that enables an agency to appeal to the Tribunal against a direction made by the Commissioner under clause 96(5)(a).

Clause 111 provides that an appeal under clause 110 must be lodged within 20 work- ing days of receiving notice of the Commissioner’s direction.
Clause 112 allows the chairperson of the Tribunal to make an interim suspending a direction made by the Commissioner under clause 96(5)(a) while an appeal is heard.

16 Privacy Bill Explanatory note The chairperson must be satisfied that suspending the direction is necessary and in the interests of justice.

A party can apply to the High Court to vary or rescind an interim order, unless the order was made with that party’s consent.
An application to the High Court can be made only with the leave of the Tribunal.

If an application is made, a party cannot also appeal the interim order.

Clause 113 provides that the Tribunal may determine an appeal on the papers if it considers it appropriate, but before doing so the Tribunal must give the parties a reasonable opportunity to comment on whether the proceeding should be dealt with in that manner.

Clause 114 sets out the powers of the Tribunal on hearing an appeal.
The Tribunal may require the Commissioner to provide either or both of the following: • • a written report setting out the considerations the Commissioner had regard to in making the direction: any information held by the Commissioner required to determine the appeal.

The Tribunal may confirm, modify, or reverse the direction appealed against, and may also award damages.
Miscellaneous Clause 115 re-enacts section 85(2) and (3), and 86(4) of the Privacy Act 1993 and provides that the Tribunal may award costs against either party.

Clause 116 re-enacts section 89 of the Privacy Act 1993 and applies relevant provi- sions of the Human Rights Act 1993 to proceedings of the Tribunal.

Part 6 Notifiable privacy breaches and compliance notices Subpart 1—Notifiable privacy breaches Clause 117 sets out definitions for 3 terms used in subpart 1 of Part 6.
Those terms are affected individual, notifiable privacy breach, and privacy breach.

Clause 117 also states that the meanings of access, disclosure, and loss are not limited by the use of those words or the meanings ascribed to them elsewhere in the Act.

Clause 118 requires an agency to notify the Commissioner if the agency suffers a no- tifiable privacy breach as soon as practicable after becoming aware of it.
Clause 119 requires an agency to notify any affected individual if the agency suffers a notifiable privacy breach as soon as practicable after becoming aware of it.

If it is not reasonably practicable to notify an affected individual or each member of a group of affected individuals, the agency must instead give public notice of the privacy breach.

Exceptions to both these requirements are set out in clause 120.
If subclause (2) or an exception in clause 120 is relied on, the agency must at a later time notify an affected individual, if circumstances change so that subclause (2) or the exception no longer applies and if, at that later time, there is or remains a risk that the breach will cause Explanatory note Privacy Bill 17 harm to an individual.

Harm is defined by reference to clause 75(2)(b).

A failure to notify an affected individual may be an interference with privacy under clause 75(2)(a)(iv).
Clause 120 sets out 6 exceptions to the requirement to notify affected individuals or give public notice of a notifiable privacy breach.

3 of these exceptions come from section 6(a), (c), and (d) of the Official Information Act 1982.

The other 2 exceptions apply to 2 categories of vulnerable persons.
These are individuals aged under 16 years, if notification is contrary to the interests of the individual and any individual, if notification is likely to prejudice the physical or mental health of that individual.

In both cases the agency must consider whether to instead notify a representative of the individual.
Representative is defined as a parent or guardian (for individuals aged under 16 years) or an individual appearing to be lawfully acting on behalf of the affected individual or in his or her interests (for individuals aged 16 years or over).

The agency must notify the Commissioner as soon as practicable if the agency relies on any of the exceptions and also if the agency cannot, or decides not to, notify a rep- resentative.
Clause 121 sets out the types of information that must be included in notifications to the Commissioner or affected persons.

A notification to an affected individual must not include information about other affected individuals.

The information can be pro- vided incrementally.

Clause 122 creates an offence if an agency, without reasonable excuse, fails to notify the Commissioner of a notifiable privacy breach.

The penalty is a fine not exceeding $10,000.


It is not a defence that the agency did not consider the privacy breach to be a notifiable privacy breach, when it was reasonable to have done so, or that the agency has taken steps to address the privacy breach.

Clause 123 allows the Commissioner to publish the identity of an agency that has no- tified him or her of a notifiable privacy breach if the agency consents or if the Com- missioner is satisfied that it is the public interest to do so.
Subpart 2—Compliance notices Clause 124 allows the Commissioner to issue a compliance notice to an agency if he or she considers that 1 or both of the things listed in the clause may have occurred.
These are— • • a breach of the Act, including an action listed in clause 75(2)(a) (which lists actions that may be an interference with privacy, for example, a breach of an IPP) or non-compliance with a PRPP: an action that is to be treated as a breach of an IPP or an interference with the privacy of an individual under another Act.

The Commissioner may, but is not required to, first make an assessment of whether any person has suffered harm or use any other means under any Act for dealing with the breach.
The Commissioner may issue a compliance notice at any time, including at the same time that the breach is being dealt with in another way.

18 Privacy Bill Explanatory note Clause 125 sets out factors the Commissioner must consider before issuing a compli- ance notice.

Each of the factors needs to be considered only to the extent that the Commissioner considers it is relevant and information about the factor is readily available to the Commissioner.
Before a compliance notice can be issued, the agency concerned must be given a reasonable opportunity to comment on a written notice— • • • • • describing the breach, citing the relevant statutory provision or provisions: summarising the Commissioner’s conclusions about the factors he or she has considered: describing any particular steps the Commissioner proposes to require the agency to take to remedy the breach (if any): describing any conditions the Commissioner proposes to impose (if any): stating the date or dates by which the Commissioner proposes the agency must remedy the breach and report to him or her (if any).
In each case, the Commissioner must determine what is a reasonable period to give the agency to comment, taking into account the circumstances of the breach.

The term breach is defined as meaning any of the things described in clause 124(1)(a) and (b).

The term remedy the breach is defined as meaning to comply with the rele- vant statutory provision or provisions.

Clause 126 sets out requirements for the form and service of a compliance notice.
Clause 127 requires an agency served with a compliance notice to take steps to com- ply with the notice as soon as practicable after receiving the notice and to remedy the breach by the date stated in the notice.

The agency need not do so if that date is varied or modified, or the notice is cancelled or suspended, under subpart 2 of Part 6.

Clause 128 allows the Commissioner to vary or cancel all or part of a compliance no- tice in 3 specified circumstances.
Clause 129 gives the Commissioner a power to obtain information, including a power to summons a person, as if the Commissioner were carrying out an investigation under Part 5.

Clause 130 allows the Commissioner to take enforcement proceedings in the Human Rights Review Tribunal.
The Commissioner must have reason to believe that the agency has not remedied or will not remedy the breach by the date stated in the com- pliance notice, or has failed to report to the Commissioner by the date stated in the notice, and the time for an appeal against the notice has passed.

An agency may object to enforcement only on the ground that it believes the notice has been fully complied with.
The Tribunal must not examine or make any determination about the issuing or merits of a compliance notice but may examine and determine whether it has been fully complied with.

Clause 131 allows an agency to appeal to the Tribunal against all or part of a compli- ance notice or a decision by the Commissioner under clause 128 to vary, not vary, or Explanatory note Privacy Bill 19 not cancel a compliance notice.
Clause 131 also sets out the powers of the Tribunal on appeal and specifies 2 reasons for which a compliance notice cannot be cancelled or modified by the Tribunal.

These are— • • the breach was unintentional or without negligence on the part of the agency: the agency has taken steps to remedy the breach, unless there is no further reasonable step that can be taken.
Clause 132 allows the Chairperson of the Tribunal to make an interim order suspend- ing all or part of a compliance notice while an appeal is heard.

The Chairperson must be satisfied that suspending the notice is necessary and in the interests of justice.

A party can apply to the High Court to vary or rescind an interim order, unless the order was made with the party’s consent.

An application to the High Court can be made only with the leave of the Tribunal.
If an application is made, a party cannot also ap- peal the interim order.

Clause 133 sets out the remedies that may be given by the Tribunal in enforcement proceedings and on appeal against a compliance notice or a decision under clause 128.

An agency that, without reasonable excuse, fails to comply with certain orders of the Tribunal commits an offence and is liable on conviction to a fine not exceeding $10,000.

Costs may be awarded by the Tribunal and enforced in the District Court.
Clause 134 applies Part 4 of the Human Rights Act 1993 to proceedings under sub- part 2 of Part 6.

Part 4 relates to the constitution, powers, and procedure of the Tribu- nal.

It also allows for appeals to the High Court and Court of Appeal.

Sections 97, 108A, and 108B in Part 4 of the Human Rights Act 1993 do not apply to proceedings under subpart 2 of Part 6.

All other sections in Part 4 apply with any necessary modi- fications.
Clause 135 allows the Commissioner to appear in proceedings under subpart 2 of Part 6 either in person or represented by counsel or an agent.
Part 7 Sharing, accessing, and matching personal information Subpart 1—Information sharing Clauses 136 to 161 re-enact Part 9A and Schedule 2A of the Privacy Act 1993 (that authorise information sharing in accordance with an approved information sharing agreement to facilitate the provision of public services) with the following substantive changes: • • a new term, specified organisation, is introduced, which means any of a num- ber of specified Crown agencies (statutory entities named in Part 1 of Schedule 1 of the Crown Entities Act 2004) (clause 138): the current requirement that 1 of the parties to an agreement must be a depart- ment, or part of a department, is changed so that a specified organisation, or part of a specified organisation, may be a requisite party (clause 141): 20 • • • Privacy Bill Explanatory note the concept of representative party has been removed and replaced by a provi- sion that enables an agreement to apply to a class of agencies, and for any member of that class to subsequently become a party to the agreement by being named as a party in a schedule to the agreement (clause 142): a specified organisation will be able to be designated as the lead agency for an agreement (clause 143): parties proposing to enter into an information sharing agreement that specifies a class of agencies to which the agreement may apply must consult and invite submissions on the proposed agreement from any person or organisation repre- senting that class (clause 150).
Subpart 2—Identity information Clauses 162 to 168 re-enact Part 10A and Schedule 4A of the Privacy Act 1993 (which authorise specified agencies, when carrying out particular functions, to access information held by other specified agencies to verify the identity of individuals) without change.
Subpart 3—Law enforcement information Clauses 169 to 173 re-enact Part 11 and Schedule 5 of the Privacy Act 1993 (which authorise specified public sector agencies to have access to law enforcement informa- tion held by other specified agencies about identifiable individuals) with the follow- ing substantive changes: • • clause 172 clarifies that access to court information under new Schedule 5 af- forded by this provision prevails over section 237 (and Schedule 1) of the Dis- trict Court Act 2016 and section 174 (and Schedule 2) of the Senior Courts Act 2016.
This means that public sector agencies can access court information under subpart 3 of Part 7 without having an approved information sharing agreement in place, as required by the latter provisions: clause 173 provides that Schedule 5 (other than law enforcement information described in that schedule as court records) may be amended or replaced by Order in Council on the recommendation of the Minister of Justice after con- sultation with the Commissioner.
Subpart 4—Authorised information matching programmes Clauses 174 to 191 re-enact Part 10 and Schedules 3 and 4 of the Privacy Act 1993 (which authorise agencies to compare personal information in accordance with an authorised information matching programme).

However, subpart 4 of Part 7 will apply to only the authorised information matching programmes currently in existence.

New information matching programmes cannot be entered into under subpart 4 of Part 7.
This is implemented by— • inserting a new application provision (clause 175): Explanatory note Privacy Bill 21 • • • carrying over into the Bill the information matching provisions listed in Sched- ule 3 of the Privacy Act 1993, except those provisions that currently have no agreements sitting under them (Schedule 6): providing that Schedule 6 (Information matching provisions) may be amended by Order in Council on the recommendation of the Minister of Justice by up- dating or repealing any information matching provision or repealing Schedule 6 in its entirety: inserting a schedule that consequentially amends other enactments to provide that existing information matching agreements can continue, but no new infor- mation matching agreement can be entered into under an information matching provision (Schedule 8).
The following substantive changes are also made: • • • • the definition of adverse action is amended to include, as examples, decisions to impose a penalty and to recover a penalty or fine: carrying over into the Bill the information matching rules set out in Schedule 4 of the Privacy Act 1993, except clauses 3 and 8 (relating to on-line transfers and time limits) (Schedule 7): section 98 of the Privacy Act 1993 (information matching guidelines) has not been carried over: section 101 of the Privacy Act 1993 is now incorporated in clause 5 of the in- formation matching rules set out in Schedule 7.
Part 8 Transfer of personal information outside New Zealand Clauses 192 to 200 re-enact, without change, Part 11A of the Privacy Act 1993.

Part 9 Miscellaneous provisions Clause 201 re-enacts section 23 of the Privacy Act 1993 and requires an agency to appoint at least 1 privacy officer.

Clause 202 re-enacts section 22 of the Privacy Act 1993 and provides that the Com- missioner may require an agency to supply information needed to respond to inquiries from the public.
Clause 203 provides that when conducting an inquiry under clause 14(1)(i) the Com- missioner has the same powers as when conducting an investigation under Part 5.

Clause 204 re-enacts section 20 of the Privacy Act 1993 and relates to the obtaining of declaratory judgments.

Clause 205 re-enacts section 115 of the Privacy Act 1993 and protects agencies from legal liability where personal information is made available in good faith under IPP 6.
22 Privacy Bill Explanatory note Clause 206 re-enacts section 116 of the Privacy Act 1993 and requires the Commis- sioner and his or her staff to maintain secrecy.

Clause 207 is a new provision and enables the Commissioner to share information with overseas privacy enforcement authorities subject to any conditions the Commis- sioner considers appropriate.
Clause 208 re-enacts sections 117, 117A, and 117B of the Privacy Act 1993 and pro- vides for the Commissioner to consult the Ombudsman, the Health and Disability Commissioner, and the Inspector-General of Intelligence and Security about any matter relating to his or her functions.
Clause 209 re-enacts section 119 of the Privacy Act 1993 and prevents claims of pub- lic interest immunity, in order to exclude evidence, in the course of investigations by the Commissioner, proceedings before the Commissioner or the Tribunal, or in judicial review proceedings.
Clause 210 re-enacts section 120 of the Privacy Act 1993 and provides that the Com- missioner must not, in any report or statement, make any comment that is adverse to any person unless that person has been given the opportunity to be heard.

Clause 211 re-enacts section 126 of the Privacy Act 1993 and deals with liability of employers and principals.

Clause 212 re-enacts section 127 of the Privacy Act 1993 and is an offence provision.
There are 2 new offences relating to impersonation and the destruction of documents.

The penalty for all offences in this clause is, on conviction, a fine not exceeding $10,000 (up from $2,000 in the case of existing offences).

Clause 213 re-enacts section 128 of the Privacy Act 1993 and provides for the mak- ing of regulations.

A new provision is inserted to provide for the making of regula- tions specifying the information to be included in a compliance notice.
Clause 214 repeals the Privacy Act 1993 and revokes the Privacy Regulations 1993.

Cause 215 consequentially amends the enactments specified in Schedule 10.

Clause 216 provides that clause 215 and Schedule 10 expire on 1 January 2020 and at the close of that date are repealed.
Hon Andrew Little Privacy Bill Government Bill Contents Title Commencement Part 1 Preliminary provisions Subpart 1—Preliminary matters Purpose of this Act Transitional, savings, and related provisions Act binds the Crown Subpart 2—Interpretation and related matters Interpretation Personal information held by agency if held by officer, employee, or member of agency Personal information treated as being held by agency in certain circumstances Actions of, and disclosure of information to, staff of agency, etc Part 2 Privacy Commissioner Subpart 1—Appointment of Privacy Commissioner 10 11 12 13 Privacy Commissioner Deputy Privacy Commissioner Holding of other offices Superannuation or retiring allowances 34—1 Page 9 9 9 9 9 10 14 14 15 15 15 16 16 1 Privacy Bill Subpart 2—Functions of Privacy Commissioner Functions of Commissioner Commissioner to monitor operation of Act Responsible Minister must present to House of Representatives copy of report under section 15 Duty to act independently Commissioner to have regard to certain matters Part 3 Information privacy principles, public register privacy principles and codes of practice Subpart 1—Information privacy principles Information privacy principles Application of IPPs to personal information held overseas Application of IPPs to public registers Relationships between IPPs and other law Exemptions relating to IPPs 1 to 4 and 12 Exemption for personal information relating to personal or domestic affairs Exemption for intelligence and security agencies Certain personal information exempt from IPPs 6 and 7 Commissioner may authorise collection, use, storage, or disclosure of personal information otherwise in breach of IPP 2, 9, 10, or 11 Enforceability of IPPs Subpart 2—Public register privacy principles Interpretation Public register privacy principles Compliance with PRPPs Relationship between PRPPs and other laws Enforceability of PRPPs Power to amend Schedule 2 by Order in Council Subpart 3—Codes of practice Codes of practice in relation to IPPs
 Codes of practice in relation to public registers Relationship between codes and other law Issue of code of practice Urgent issue of code of practice Notification, availability, and commencement of code Application of Legislation Act 2012 to codes Amendment and revocation of codes Effect of code Privacy Bill Part 4 Access to and correction of personal information Subpart 1—Access to personal information Interpretation Individuals may make access request Urgency Assistance Transfer of access request Decision on access request under IPP 6(1)(a) Decision on access request under IPP 6(1)(b) Extension of time limits Protection, etc, of individual as reason for refusing request under IPP 6(1)(b) Evaluative material as reason for refusing request under IPP 6(1)(b) Security, defence, international relations as reason for refusing request under IPP 6(1)(b) Trade secret as reason for refusing request under IPP 6(1)(b) Administrative reasons for refusing request under IPP 6(1)(b) Other reasons for refusing request under IPP 6(1)(b) Agency may impose conditions instead of refusing access to information under section 57 Requestor to be informed of certain matters if response given under section 49(2)(c) or 50(2)(c) Requestor to be informed of certain matters if request under IPP 6(1)(b) refused Withholding information requested under IPP 6(1)(b) contained in document Ways information may be made available Responsibilities of agency before giving access to information Subpart 2—Correction of personal information Interpretation Individuals may make correction requests Urgency Assistance Transfer of correction request Decision on request under IPP 7(1)(a) Decision on request under IPP 7(2)(b) Extension of time limits Subpart 3—Charges Charges Commissioner may authorise public sector agency to impose
 charge Privacy Bill Part 5 Complaints, investigations, and proceedings Interpretation Interference with privacy of individual Subpart 1—Complaints Types of complaints Who may make complaint Form of complaint Procedure on receipt of complaint Commissioner may decide not to investigate complaint Commissioner may decide to defer taking action on complaint Referral of complaint to another person Referral of complaint to overseas privacy enforcement authority Exploring possibility of settlement and assurance before investigating complaint Subpart 2—Investigations by Commissioner Application of this subpart Commencing investigation Exploring possibility of settlement and assurance during investigation Conducting investigation Commissioner may regulate own procedure Compulsory conferences of parties to complaint Power to summon persons Power to require information and documents Disclosure of information may be required despite obligation of secrecy Protection and privileges of persons required to provide information, etc Disclosed information privileged Procedure after completion of investigation relating to breach of IPP 6 Procedure after completion of investigation relating to charging Procedure after completion of investigation relating to public register Procedure after completion of other investigations Special procedure relating to intelligence and security agency Commissioner to report breach of duty or misconduct Subpart 3—Proceedings before Human Rights Review Tribunal Proceedings in relation to complaints or investigations Director may commence proceedings in Tribunal Aggrieved individual may commence proceedings in Tribunal 98
83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 4 Privacy Bill Right of Director to appear in proceedings commenced under section 103 Apology not admissible except for assessment of remedies Onus of proof Remedies in respect of interference with privacy Damages Access orders Enforcement of direction made by Commissioner under section 96(5)(a) after investigation of IPP 6 breach Appeals against direction made after investigation of IPP 6 breach Appeal to Tribunal against direction of Commissioner under section 96(5)(a) Time for lodging appeal Interim order suspending Commissioner’s direction pending appeal Appeal may be determined on papers Determination of appeal Miscellaneous Costs Certain provisions of Human Rights Act 1993 to apply Part 6 Notifiable privacy breaches and compliance notices Subpart 1—Notifiable privacy breaches Interpretation Agency to notify Commissioner of notifiable privacy breach Agency to notify affected individual or give public notice of notifiable privacy breach Exceptions to obligations to notify affected individual or give public notice of notifiable privacy breach Requirements for notification Offence to fail to notify Commissioner Publication of identity of agencies in certain circumstances Subpart 2—Compliance notices Compliance notices Issuing compliance notice Form and service of compliance notice Agency response to compliance notice Commissioner may vary or cancel compliance notice Commissioner’s power to obtain information 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 Enforcement of compliance notice Proceedings Privacy Bill Appeal against compliance notice or Commissioner’s decision under section 128 Interim order suspending compliance notice pending appeal Remedies, costs, and enforcement
 Application of Human Rights Act 1993 Commissioner may be represented in proceedings Part 7 Sharing, accessing, and matching personal information Subpart 1—Information sharing Purpose of this subpart Relationship between subpart 1 and other law relating to information disclosure Interpretation Information sharing between agencies Information sharing within agencies Parties to information sharing agreement Agreement may apply to classes of agencies Lead agency Form and content of information sharing agreement Governor-General may approve information sharing agreement by Order in Council Requirements for Order in Council Further provisions about Order in Council Status of Order in Council Matters to which relevant Minister must have regard before recommending Order in Council Consultation on proposed information sharing agreement Commissioner may prepare and publish report on approved information sharing agreement Requirement to give notice of adverse action When requirement to give notice of adverse action applies Responsibilities of lead agency Report of lead agency Commissioner may specify frequency of reporting by lead agency Amendment of approved information sharing agreement Review of operation of approved information sharing agreement Report on findings of review Relevant Minister must present to House of Representatives copy of report under section 159(1) and report setting out Government’s response Power to amend Schedule 3 Subpart 2—Identity information 162 Purpose of this subpart Privacy Bill Relationship between this subpart and other law relating to information disclosure Interpretation Access by agencies to identity information Manner and form of access Annual reporting requirement Power to amend Schedule 4 by Order in Council Subpart 3—Law enforcement information Purpose of this subpart Relationship between this subpart and other law relating to information
 disclosure Interpretation Access by accessing agencies to law enforcement information Power to amend Schedule 5 by Order in Council Subpart 4—Authorised information matching programmes Purpose of this subpart Application of this subpart Relationship between this subpart and other law relating to information disclosure Interpretation Information matching agreements Use of results of authorised information matching programme Extension of time limit Notice of adverse action proposed Reporting requirements Reports on authorised information matching programmes Reports on information matching provisions Responsible Minister must present to House of Representatives copy of report under section 184 and report setting out Government’s response Avoidance of controls on information matching through use of exceptions to information privacy principles Avoidance of controls on information matching through use of official information statutes Power to amend Schedule 6 by Order in Council Power to amend Schedule 7 by Order in Council Amendments to other enactments related to this subpart Expiry of section 190 and Schedule 8 Part 8 Transfer of personal information outside New Zealand Interpretation Prohibition on transfer of personal information outside New Zealand Privacy Bill Commissioner’s power to obtain information Transfer prohibition notice Commissioner may vary or cancel notice Offence in relation to transfer prohibition notice Appeals against transfer prohibition notice Application of Human Rights Act 1993 Power to amend Schedule 9 Part 9 Miscellaneous provisions General Privacy officers Commissioner may require agency to supply information Inquiries Powers
 relating to declaratory judgments Protection against certain actions Commissioner and staff to maintain secrecy Commissioner may share information with overseas privacy enforcement authority Consultation Exclusion of public interest immunity Adverse comment Liability and offences Liability of employers and principals Offences Regulations 213 Regulations Repeal, revocation, and consequential amendments 214 215 216 Repeal and revocation Consequential amendments Expiry of section 215 and Schedule 10 Schedule 1 Transitional, savings, and related provisions Schedule 2 Public registers Schedule 3 Approved information sharing agreements Schedule 4 Identity information Schedule 5 Law enforcement information 8 110 110 111 112 112 113 113 113 113 114 114 114 114 115 116 116 116 116 117 118 118 118 118 119 122 124 131 133 Privacy Bill Part 1 cl 5 Schedule 6 Information matching provisions Schedule 7 Information matching rules Schedule 8 Amendments to other enactments related to subpart 4 of Part 7 Schedule 9 Basic principles of national application set out in Part Two of the OECD Guidelines Schedule 10 Consequential amendments 142 143 146 156 158 The Parliament of New Zealand enacts as follows: 1 2 Title This Act is the Privacy Act 2018.
Commencement This Act comes into force on 1 July 2019.
5 Part 1 Preliminary provisions Subpart 1—Preliminary matters 3 Purpose of this Act The purpose of this Act is to promote and protect individual privacy by— 10 (a) (b) providing a framework for protecting an individual’s right to privacy of personal information, while recognising that other rights and interests may at times also need to be taken into account; and to give effect to internationally recognised privacy obligations and stand- ards in relation to the privacy of personal information, including the OECD Guidelines and the International Covenant on Civil and Political Rights.
15 Transitional, savings, and related provisions The transitional, savings, and related provisions set out in Schedule 1 have effect according to their terms.

20 Act binds the Crown This Act binds the Crown.
Compare: 1993 No 28 s 5 4 5 9 Part 1 cl 6 Privacy Bill Subpart 2—Interpretation and related matters 6 Interpretation In this Act, unless the context otherwise requires,— action includes failure to act, and also includes any policy or practice agency— (a) means any person or body of persons, whether corporate or unincorpo- rate, and whether in the public sector or the private sector and, to avoid doubt, includes a department; but (b) does not include— (i) (ii) (iii) (iv) (v) (vi) the Sovereign; or the Governor-General or the Administrator of the Government; or the House of Representatives; or a member of Parliament in his or her official capacity; or the Parliamentary Service Commission; or the Parliamentary Service, except in relation to personal informa- tion about any employee or former employee of that agency in his or her capacity as such an employee; or (vii) in relation to its judicial functions, a court; or (viii) in relation to its judicial functions, a tribunal; or (ix) (x) (xi) an Ombudsman; or an inquiry; or a board of inquiry or court of inquiry appointed under any Act to inquire into a specified matter; or (xii) in relation to its news activities, any news medium collect, in relation to personal information, means to take any step to seek or obtain the personal information, but does not include receipt of unsolicited in- formation Commissioner means the Privacy Commissioner holding office under sec- tion 10 and appointed in accordance with section 28(1)(b) of the Crown En- tities Act 2004 correct, in relation to personal information, means to alter that information by way of correction, deletion, or addition, and correction has a corresponding meaning court, in relation to subpart 3 of Part 7, means a court carrying out its ad- ministrative and judicial functions 35 department means a government department named in Part 1 of Schedule 1 of the Ombudsmen Act 1975 10 Privacy Bill Part 1 cl 6 Deputy Commissioner means the Deputy Privacy Commissioner appointed under section 11 Director of
 Human Rights Proceedings or Director means the Director of Human Rights Proceedings or alternate Director of Human Rights Proceedings appointed under section 20A of the Human Rights Act 1993 document means a document in any form, and includes— (a) (b) (c) (d) (e) any writing on any material: any information recorded or stored by means of any computer or other device, and any material subsequently derived from information so re- corded or stored: any label, marking, or other writing that identifies or describes any thing of which it forms part, or to which it is attached by any means: any book, map, plan, graph, or drawing: any photograph, film, negative, tape, or any device in which 1 or more visual images are embodied so as to be capable (with or without the aid of some other equipment) of being reproduced 5 10 15 Human Rights Review Tribunal or Tribunal means the Human Rights Re- view Tribunal continued by section 93 of the Human Rights Act 1993 individual means a natural person, other than a deceased natural person individual concerned, in relation to personal information, means the individu- al to whom the information relates 20 information privacy principle or IPP means an information privacy principle set out in section 19 inquiry means an inquiry to which section 6 of the Inquiries Act 2013 applies intelligence and security agency means— (a) (b) the New Zealand Security Intelligence Service; and the Government Communications Security Bureau international organisation means any organisation of States or Governments of States or any organ or agency of any such organisation, and includes the Commonwealth Secretariat local authority— (a) means a local authority or public body named or specified in Schedule 1 of the Local Government Official Information and Meetings Act 1987; and (b) includes— (i) any committee, subcommittee, standing committee, special com- mittee, joint standing committee, or joint special committee that the local authority is empowered to appoint under
 its standing orders or rules of procedure or under any enactment or Order in 25 30 35 11 Part 1 cl 6 Privacy Bill Council constituting the local authority or regulating its proceed- ings; and (ii) a committee of the whole local authority Minister means a Minister of the Crown in his or her official capacity news activity means— 5 (a) the gathering of news, or the preparation or compiling of articles or pro- grammes of or concerning news, observations on news, or current af- fairs, for the purposes of dissemination to the public or any section of the public: (b) the dissemination, to the public or any section of the public, of any art- icle or programme of or concerning— 10 (i) (ii) news: observations on news: (iii) current affairs news medium means any agency whose business, or part of whose business, consists of a news activity but, in relation to IPPs 6 and 7, does not include Radio New Zealand Limited or Television New Zealand Limited OECD Guidelines means the Organisation for Economic Co-operation and Development Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data Ombudsman means an Ombudsman appointed under the Ombudsmen Act 1975 15 20 organisation— (a) means— (i) (ii) an organisation named in Part 2 of Schedule 1 of the Ombudsmen Act 1975; and 25 an organisation named in Schedule 1 of the Official Information Act 1982; and (b) includes the Office of the Clerk of the House of Representatives overseas privacy enforcement authority means an overseas body that is re- sponsible for enforcing legislation to protect personal information, and that has the power to conduct investigations and pursue enforcement proceedings permanent resident of New Zealand means a person who— (a) (b) resides in New Zealand; and is not— 30 35 (i) a person to whom section 15 or 16 of the Immigration Act 2009 applies (except if the person has been granted a visa or entry per- mission in accordance with section 17 of that Act); or 12 Privacy Bill Part 1
 cl 6 (ii) (iii) a person obliged by or under that Act to leave New Zealand im- mediately or within a specified time; or treated for the purposes of that Act as being unlawfully in New Zealand personal information means information about an identifiable individual, and includes information relating to a death that is maintained by the Registrar- General under the Births, Deaths, Marriages, and Relationships Registration Act 1995 or any former Act (as defined by the Births, Deaths, Marriages, and Relationships Registration Act 1995) 5 private sector agency means an agency that is not a public sector agency 10 public register has the meaning given to it in section 29 public register privacy principle or PRPP means a public register privacy principle set out in section 30 public sector agency— (a) means an agency that is a Minister, a department, an organisation, or a 15 local authority; and (b) includes any agency that is an unincorporated body (being a board, council, committee, or other body)— (i) (ii) that is established for the purpose of assisting or advising, or per- forming functions connected with, any public sector agency with- in the meaning of paragraph (a); and that is established in accordance with the provisions of any enact- ment or by any such public sector agency 20 publicly available information means personal information that is contained in a publicly available publication 25 publicly available publication— (a) means a publication in printed or electronic form that is, or will be, gen- erally available to members of the public free of charge or on payment of a fee; and (b) includes a statutory register to the extent that the statutory register may be accessed by members of the public 30 responsible Minister means the Minister of Justice serious threat, for the purposes of IPP 10(1)(f) or 11(1)(f), means a threat that an agency reasonably believes to be a serious threat having regard to all of the following: 35 (a) (b) (c) the likelihood of the threat
 being realised; and the severity of the consequences if the threat is realised; and the time at which the threat may be realised statutory register— 13 Part 1 cl 7 Privacy Bill (a) means a register, list, or roll of data that is created and maintained (in printed or electronic form) under an enactment; and (b) includes a public register unique identifier, in relation to an individual, means an identifier other than the individual’s name that uniquely identifies the individual 5 working day means any day of the week other than— (a) (b) (c) a Saturday, a Sunday, Waitangi Day, Good Friday, Easter Monday, An- zac Day, the Sovereign’s birthday, or Labour Day; or if Waitangi Day or Anzac Day falls on a Saturday or a Sunday, the fol- lowing Monday; or 10 a day in the period commencing on 25 December in one year and ending with 15 January in the next year.
Compare: 1993 No 28 s 2(1) 7 (1) Personal information held by agency if held by officer, employee, or member of agency 15 For the purposes of this Act, personal information held by a person in the per- son’s capacity as an officer, an employee, or a member of an agency is to be treated as being held by the agency.
(2) However, subsection (1) does not apply to— (a) personal information held by an officer, an employee, or a member of a public sector agency (Agency A) if— 20 (i) (ii) the information is held only because of the person’s connection with a private sector agency; and that connection is not in the person’s capacity as an officer, an employee, or a member of Agency A; or 25 (b) personal information held by an officer, an employee, or a member of a private sector agency (Agency B) if— (i) (ii) the information is held only because of the person’s connection with another agency (whether a public sector agency or private sector agency); and that connection is not in the person’s capacity as an officer, an employee, or a member of Agency B.
Compare: 1993 No 28 s 3(1)–(3) Personal information treated as being held by agency in certain circumstances For the purposes of this Act, personal information is treated as being held by an agency (Agency A) even if another agency (Agency B) holds the informa- tion— 30 35 8 (1) 14 5 10 15 20 Privacy Bill Part 2 cl 11 (a) (b) (c) as agent for Agency A; or for the purpose of safe custody on behalf of Agency A; or for the purpose of processing the information on behalf of Agency A.
(2) For the purposes of this section, it does not matter whether Agency B— (a) (b) is outside New Zealand; or holds the information outside New Zealand.

Compare: 1993 No 28 s 3(4) 9 Actions of, and disclosure of information to, staff of agency, etc For the purposes of this Act, an action done by, or information disclosed to, a person employed by, or in the service of, an agency in the performance of the duties of the person’s employment is to be treated as having been done by, or disclosed to, the agency.
Compare: 1993 No 28 s 4 10 (1) (2) (3) 11 (1) (2) (3) Part 2 Privacy Commissioner Subpart 1—Appointment of Privacy Commissioner Privacy Commissioner There continues to be a Commissioner called the Privacy Commissioner.

The Commissioner is— (a) (b) a corporation sole; and a Crown entity for the purposes of section 7 of the Crown Entities Act 2004; and (c) the board for the purposes of the Crown Entities Act 2004.
The Crown Entities Act 2004 applies to the Commissioner except to the extent that this Act expressly provides otherwise.

25 Compare: 1993 No 28 s 12 Deputy Privacy Commissioner The Governor-General may, on the recommendation of the Minister, appoint a Deputy Privacy Commissioner.

Part 2 of the Crown Entities Act 2004, except section 46, applies to the ap- pointment and removal of a Deputy Commissioner in the same manner as it ap- plies to the appointment and removal of the Commissioner.
30 Subject to the control of the Commissioner, the Deputy Commissioner may perform or exercise all the functions, duties, and powers of the Commissioner.

15 Part 2 cl 12 Privacy Bill (4) When there is a vacancy in the position of Commissioner or when the Commis- sioner is (for whatever reason) absent from duty, the Deputy Commissioner may perform or exercise all the functions, duties, and powers of the Commis- sioner.
(5) 12 (1) The Deputy Commissioner is entitled to all the protections, privileges, and im- munities of the Commissioner.

5 Compare: 1993 No 28 s 15 Holding of other offices In addition to the persons specified in section 30(2) of the Crown Entities Act 2004, a member of a local authority is disqualified from being appointed as the Commissioner or Deputy Commissioner.
(2) If a Judge is appointed as the Commissioner or Deputy Commissioner,— (a) the appointment does not affect his or her tenure of judicial office, rank, title, status, precedence, salary, annual or other allowances, or other rights or privileges as a Judge (including those in relation to superannu- ation); and (b) for all purposes, the Judge’s service as Commissioner or Deputy Com- missioner must be taken to be service as a Judge.
13 (1) (2) (3) Compare: 1993 No 28 s 19 Superannuation or retiring allowances For the purpose of providing superannuation or retiring allowances for the Commissioner or Deputy Commissioner, the Commissioner may, out of the funds of the Commissioner, make payments to or subsidise any retirement scheme (within the meaning of section 6(1) of the Financial Markets Conduct Act 2013).
Subsections (3) to (5) apply to a person who, immediately before being ap- pointed as the Commissioner or the Deputy Commissioner or, as the case may be, becoming an employee of the Commissioner, is a contributor to the Gov- ernment Superannuation Fund under Part 2 or 2A of the Government Super- annuation Fund Act 1956 (the 1956 Act).
The person is, for the purposes of the 1956 Act, to be treated as if he or she continues to be employed in the Government service while the person is the Commissioner or Deputy Commissioner or, as the case may be, an employee of the Commissioner.

(4) However, if the person ceases to be a contributor to the Government Super- annuation Fund after his or her appointment or employment, the person may not resume making contributions to the Fund.
(5) For the purposes of applying the 1956 Act to a person under this section, con- trolling authority, in relation to the person, means the Commissioner.
Compare: 1993 No 28 Schedule 1 cl 4 16 10 15 20 25 30 35 40 Privacy Bill Part 2 cl 14 Subpart 2—Functions of Privacy Commissioner 14 (1) Functions of Commissioner The functions of the Commissioner are— (a) (b) (c) (d) (e) (f) (g) (h) (i) (j) (k) (l) to exercise the powers, and carry out the functions and duties, conferred on the Commissioner by or under this Act or any other enactment: 5 to provide advice (with or without a request) to a Minister or an agency on any matter relevant to the operation of this Act: to promote, by education and publicity, an understanding and acceptance of the information privacy principles and of the objectives of those prin- ciples: 10 to make public statements in relation to any matter affecting the privacy of individuals: to receive and invite representations from members of the public on any matter affecting the privacy of individuals: to consult and co-operate with other persons and bodies concerned with the privacy of individuals: 15 to examine any proposed legislation (including subordinate legislation) or proposed government policy that the Commissioner considers may af- fect the privacy of individuals, including any proposed legislation that makes provision for either or both of the following: (i) (ii) the collection of personal information by a public sector agency: the sharing of personal information between public sector agen- cies: to monitor the use of unique identifiers: to inquire generally into any matter, including any other enactment or any law, or any practice, or procedure, whether governmental or non- governmental, or any technical development, if it appears to the Com- missioner that the privacy of individuals is being, or may be, infringed (for powers of the Commissioner in relation to inquiries, see section 203): to undertake research into, and to monitor developments in, data pro- cessing and technology to ensure that any adverse effects of the develop- ments on the privacy of individuals are minimised: to give advice to any person in relation to any matter
 that concerns the need for, or desirability of, action by that person in the interests of the privacy of individuals: when requested to do so by an agency, to conduct an audit of personal information maintained by that agency for the purpose of ascertaining 20 25 30 35 17 Part 2 cl 15 Privacy Bill whether the information is maintained according to the information pri- vacy principles: (m) to report to the responsible Minister on— (i) (ii) (iii) the results of any examination conducted under paragraph (g): the results of the monitoring undertaken under paragraph (h): the results of the research and monitoring undertaken under para- graph (j): (n) to report to the Prime Minister on— (i) (ii) (iii) any matter affecting the privacy of individuals, including the need for, or desirability of, taking legislative, administrative, or other action to give protection or better protection to the privacy of indi- viduals: the desirability of New Zealand accepting any international instru- ment relating to the privacy of individuals: any other matter relating to the privacy of individuals that, in the Commissioner’s opinion, should be drawn to the Prime Minister’s attention: 5 10 15 (o) to gather any information that will assist in carrying out the functions in paragraphs (a) to (n).
(2) The Commissioner may at any time, if it is in the public interest or in the inter- ests of any person or body of persons to do so, publish— 20 (a) reports relating generally to the performance of the Commissioner’s functions under this Act: (b) reports relating to any case or cases investigated by the Commissioner.
(3) Subsection (2) applies regardless of whether the matters to be dealt with in a report under that subsection have been the subject of a report to the responsible Minister or the Prime Minister.
Compare: 1993 No 28 s 13(1), (2) 15 Commissioner to monitor operation of Act The Commissioner must— (a) monitor the operation of this Act; and 25 30 (b) (c) consider whether any amendments to this Act are necessary or desirable; and report to the responsible Minister at any time on the results of the moni- toring and on any amendments considered necessary or desirable.
35 Compare: 1993 No 28 s 26(1) 18 Privacy Bill Part 3 cl 19 16 Responsible Minister must present to House of Representatives copy of report under section 15 As soon as practicable after receiving a report under section 15, the respon- sible Minister must present a copy of the report to the House of Representa- tives.
5 Compare: 1993 No 28 s 26(2) 17 Duty to act independently The Commissioner must act independently in performing his or her statutory functions and duties, and exercising his or her statutory powers, under— (a) (b) this Act; and 10 any other Act that expressly provides for the functions, powers, or duties of the Commissioner (other than the Crown Entities Act 2004).
Compare: 1993 No 28 s 13(1A) 18 Commissioner to have regard to certain matters In performing his or her functions and duties, and in exercising his or her powers, under this Act, the Commissioner must— 15 (a) have regard to the privacy interests of individuals alongside other human rights and interests, including— (i) (ii) the desirability of facilitating the free flow of information in soci- ety; and 20 government and businesses being able to achieve their objectives efficiently; and (b) (c) (d) take account of international obligations accepted by New Zealand, in- cluding those concerning the international technology of communica- tions; and take account of cultural perspectives on privacy; and consider any developing general international guidelines relevant to the better protection of individual privacy; and (e) have regard to the IPPs and PRPPs.
Compare: 1993 No 28 s 14 Part 3 Information privacy principles, public register privacy principles and codes of practice Subpart 1—Information privacy principles 19 Information privacy principles The information privacy principles are as follows: 19 25 30 35 Part 3 cl 19 Privacy Bill Information privacy principle 1 Purpose of collection of personal information Personal information must not be collected by an agency unless— (a) the information is collected for a lawful purpose connected with a func- tion or an activity of the agency; and the collection of the information is necessary for that purpose.
Information privacy principle 2 Source of personal information If an agency collects personal information, the information must be col- lected from the individual concerned.
It is not necessary for an agency to comply with subclause (1) if the agency believes, on reasonable grounds,— (a) that non-compliance would not prejudice the interests of the indi- vidual concerned; or that compliance would prejudice the purposes of the collection; or that the individual concerned authorises collection of the infor- mation from someone else; or that the information is publicly available information; or that non-compliance is necessary— (i) (b) (c) (d) (e) to avoid prejudice to the maintenance of the law by any public sector agency, including prejudice to the prevention, detection, investigation, prosecution, and punishment of offences; or for the enforcement of a law that imposes a pecuniary pen- alty; or for the protection of public revenue; or for the conduct of proceedings before any court or tribunal (being proceedings that have been commenced or are reasonably in contemplation); or to prevent or lessen a serious threat to the life or health of the individual concerned or any other individual; or (ii) (iii) (iv) (v) (f) (g) that compliance is not reasonably practicable in the circum- stances of the particular case; or that the information— (i) will not be used in a form in which the individual concerned is identified; or (b) (1) (2) 20 Privacy Bill Part 3 cl 19 (ii) will be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned.
Information privacy principle 3 Collection of information from subject If an agency collects personal information from the individual con- cerned, the agency must take any steps that are, in the circumstances, reasonable to ensure that the individual concerned is aware of— the fact that the information is being collected; and (a) the purpose for which the information is being collected; and (b) the intended recipients of the information; and (c) the name and address of— (d) (i) (ii) if the collection of the information is authorised or required by or under law,— (i) the agency that is collecting the information; and the agency that will hold the information; and the particular law by or under which the collection of the in- formation is authorised or required; and (e) (ii) whether the supply of the information by that individual is voluntary or mandatory; and (f) (g) the consequences (if any) for that individual if all or any part of the requested information is not provided; and the rights of access to, and correction of, personal information provided by the IPPs.
The steps referred to in subclause (1) must be taken before the infor- mation is collected or, if that is not practicable, as soon as practicable after the information is collected.

An agency is not required to take the steps referred to in subclause (1) in relation to the collection of information from an individual if the agency has taken those steps on a recent previous occasion in relation to the collection, from that individual, of the same information or informa- tion of the same kind.
It is not necessary for an agency to comply with subclause (1) if the agency believes, on reasonable grounds,— (a) that non-compliance would not prejudice the interests of the indi- vidual concerned; or that non-compliance is necessary— (i) to avoid prejudice to the maintenance of the law by any public sector agency, including prejudice to the prevention, (b) (1) (2) (3) (4) 21 Part 3 cl 19 Privacy Bill (ii) (iii) (iv) detection, investigation, prosecution, and punishment of offences; or for the enforcement of a law that imposes a pecuniary pen- alty; or for the protection of public revenue; or for the conduct of proceedings before any court or tribunal (being proceedings that have been commenced or are reasonably in contemplation); or (c) (d) (e) that compliance would prejudice the purposes of the collection; or that compliance is not reasonably practicable in the circum- stances of the particular case; or that the information— (i) will not be used in a form in which the individual concerned is identified; or (ii) will be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned.
Information privacy principle 4 Manner of collection of personal information An agency may collect personal information only— (a) (b) by a lawful means; and by a means that, in the circumstances of the case (having regard particu- larly to the age of the individual concerned),— (i) (ii) is fair; and does not intrude to an unreasonable extent upon the personal af- fairs of the individual concerned.
Information privacy principle 5 Storage and security of personal information An agency that holds personal information must ensure— (a) that the information is protected, by such security safeguards as it is reasonable in the circumstances to take, against— (i) (ii) loss; and access, use, modification, or disclosure that is not authorised by the agency; and other misuse; and (iii) that, if it is necessary for the information to be given to a person in con- nection with the provision of a service to the agency, everything reason- (b) 22 Privacy Bill Part 3 cl 19 ably within the power of the agency is done to prevent unauthorised use or unauthorised disclosure of the information.
Information privacy principle 6 Access to personal information If an agency holds personal information, an individual is entitled to receive from the agency— (a) confirmation of whether the agency holds any personal informa- tion about him or her: access to his or her personal information.

(b) If an individual concerned is given access to personal information, the individual must be advised that, under IPP 7, the individual may request the correction of that information.
This principle is subject to the provisions of Part 4.

Information privacy principle 7 Correction of personal information If an agency holds personal information,— (a) an individual concerned is entitled to request the agency to cor- rect the information: the agency, on its own initiative, may correct the information.
(b) At the time of making a request under subclause (1)(a), or at any later time, the individual concerned is entitled to— (a) provide to the agency a statement of the correction sought to the information; and request the agency to attach the statement to the information if the agency is not willing to make the correction sought.
(b) If an agency corrects personal information or attaches a statement of cor- rection to personal information, that agency must, so far as is reasonably practicable, inform every other agency to whom the agency has dis- closed the personal information.

Subclauses (1) and (2) are subject to the provisions of Part 4.
(1) (2) (3) (1) (2) (3) (4) Information privacy principle 8 Accuracy, etc, of personal information to be checked before use or disclosure An agency that holds personal information must not use or disclose that infor- mation without taking any steps that are, in the circumstances, reasonable to ensure that the information is accurate, up to date, complete, relevant, and not misleading.
23 Part 3 cl 19 Privacy Bill Information privacy principle 9 Agency not to keep personal information for longer than necessary An agency that holds personal information must not keep that information for longer than is required for the purposes for which the information may lawfully be used.
Information privacy principle 10 Limits on use of personal information (1) An agency that holds personal information that was obtained in connection with one purpose may not use the information for any other purpose unless the agency believes, on reasonable grounds,— (a) that the purpose for which the information is used is directly rela- ted to the purpose in connection with which the information was obtained; or that the information— (i) is used in a form in which the individual concerned is not identified; or is used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned; or (ii) that the use of the information for that other purpose is authorised by the individual concerned; or that the source of the information is a publicly available publica- tion and that, in the circumstances of the case, it would not be un- fair or unreasonable to use the information; or that the use of the information for that other purpose is neces- sary— (i) to avoid prejudice to the maintenance of the law by any public sector agency, including prejudice to the prevention, detection, investigation, prosecution, and punishment of offences; or for the enforcement of a law that imposes a pecuniary pen- alty; or for the protection of public revenue; or for the conduct of proceedings before any court or tribunal (being proceedings that have been commenced or are reasonably in contemplation); or (ii) (iii) (iv) (b) (c) (d) (e) (f) that the use of the information for that other purpose is necessary to prevent or lessen a serious threat to— (i) public health or public safety; or 24 (2) (1) Privacy Bill Part 3 cl 19 (ii) the life or health of the individual concerned or another in- dividual.
In addition to the uses authorised by subclause (1), an intelligence and security agency that holds personal information that was obtained in connection with one purpose may use the information for any other purpose (a secondary purpose) if the agency believes on reasonable grounds that the use of the information for the secondary purpose is necessary to enable the agency to perform any of its functions.
Information privacy principle 11 Limits on disclosure of personal information An agency that holds personal information must not disclose the information to any other agency or to any person unless the agency believes, on reasonable grounds,— (a) (b) (c) (d) (e) (f) that the disclosure of the information is one of the purposes in connection with which the information was obtained or is directly related to the purposes in connection with which the information was obtained; or that the disclosure is to the individual concerned; or that the disclosure is authorised by the individual concerned; or that the source of the information is a publicly available publica- tion and that, in the circumstances of the case, it would not be un- fair or unreasonable to disclose the information; or that the disclosure of the information is necessary— (i) to avoid prejudice to the maintenance of the law by any public sector agency, including prejudice to the prevention, detection, investigation, prosecution, and punishment of offences; or for the enforcement of a law that imposes a pecuniary pen- alty; or for the protection of public revenue; or for the conduct of proceedings before any court or tribunal (being proceedings that have been commenced or are reasonably in contemplation); or (ii) (iii) (iv) that the disclosure of the information is necessary to prevent or lessen a serious threat to— (i) (ii) public health or public safety; or the life or health of the individual concerned or another in- dividual; or (g) that the disclosure of the information is necessary to enable an in- telligence and security agency to perform any of its functions; or 25 Part 3 cl 19 Privacy Bill (h) that the information— (i) (ii) is to be used in a form in which the individual concerned is not identified; or is to be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned; or (i) that the disclosure of the information is necessary to facilitate the sale or other disposition of a business as a going concern.
(2) Without limiting the generality of subclause (1)(e)(i), an example of (3) disclosure under that subclause is reporting to the New Zealand Police a reasonably held belief that an offence has been, or may be, committed.
An agency (A) may not disclose personal information to an overseas person (B) in reliance on subclause (1)(a), (c), (e), (f), (h), or (i) unless— (a) (b) section 8 applies to A and B; or the individual concerned authorises the disclosure of the informa- tion to B; or B is in a prescribed country or State; or A believes on reasonable grounds that B is required to protect the information in a way that, overall, provides comparable safe- guards to those in this Act.
(c) (d) (4) However, subclause (3) does not apply if the personal information is to be disclosed to an overseas person in reliance on subclause (1)(e) or (f) and it is not reasonably practicable in the circumstances for A to comply with the requirements of subclause (3).

(6) (5) Without limiting the generality of subclause (3)(d), an example of A having the necessary belief on reasonable grounds is A having entered into an agreement with B that provides comparable safeguards to those in this Act.
In this principle,— overseas person means a person outside New Zealand who is not subject to this Act prescribed country or State means a country or State that is specified in regulations as having privacy laws comparable to those of New Zealand.

Information privacy principle 12 Unique identifiers (1) An agency (Agency A) may assign a unique identifier to an individual for use in its operations only if that identifier is necessary to enable Agency A to carry out 1 or more of its functions efficiently.
26 Privacy Bill Part 3 cl 22 (2) (3) (4) (5) (6) Agency A may not assign to an individual a unique identifier that, to Agency A’s knowledge, is the same unique identifier as has been as- signed to that individual by another agency (Agency B), unless— (a) Agency A and Agency B are associated persons within the mean- ing of subpart YB of the Income Tax Act 2007; or the unique identifier is to be used by Agency A for statistical or research purposes and no other purpose.
(b) To avoid doubt, Agency A does not assign a unique identifier to an indi- vidual under subsection (1) by simply recording a unique identifier as- signed to the individual by Agency B for the sole purpose of communi- cating with Agency B about the individual.

Agency A must take all reasonable steps to ensure that a unique identifi- er is assigned only to an individual whose identity is clearly established.
Before disclosing a unique identifier to another agency, Agency A must take all reasonable steps to minimise the risk of misuse of the unique identifier by that other agency or any other person.

An agency may not require an individual to disclose any unique identifi- er assigned to that individual unless the disclosure is for one of the pur- poses in connection with which that unique identifier was assigned or is for a purpose that is directly related to one of those purposes.
Compare: 1993 No 28 s 6 20 (1) Application of IPPs to personal information held overseas For the purposes of IPP 5 and IPPs 8 to 11, personal information held by an agency includes personal information that is held outside New Zealand by that agency, if the information has been transferred out of New Zealand by that agency or any other agency.

5 (2) For the purposes of IPPs 6 and 7, personal information held by an agency in- cludes personal information held outside New Zealand by that agency.
(3) Nothing in this section applies to render an agency in breach of any of the IPPs in respect of any action that the agency is required to take by or under the law 10 of any place outside New Zealand.

Compare: 1993 No 28 s 10 21 Application of IPPs to public registers An agency responsible for administering a public register must, in administer- ing that register, comply, so far as is reasonably practicable, with the IPPs.
15 Compare: 1993 No 28 s 60(1) 22 Relationships between IPPs and other law (1) Nothing in IPP 6 or 11 derogates from— 27 Part 3 cl 23 Privacy Bill (a) a provision contained in any enactment that authorises or requires per- sonal information to be made available; or (b) a provision contained in any other Act that— (i) (ii) imposes a prohibition or restriction in relation to the availability of personal information; or 5 regulates the manner in which personal information may be ob- tained or made available.
(2) An action is not in breach of IPPs 1 to 5, 7 to 10, or 12 if the action is 23 (1) (2) (3) 24 (1) authorised or required by or under law.

Compare: 1993 No 28 s 7(1), (2), (4) Exemptions relating to IPPs 1 to 4 and 12 IPPs 1 to 4 apply only to personal information collected after 2 July 1993.

IPP 12(1) to (4) apply only to the assignment of unique identifiers after 2 July 1993.
IPP 12(2) applies to the assignment of a unique identifier after 2 July 1993 where the assignment is in respect of a unique identifier that is the same as that assigned by another agency before or after that date.
Compare: 1993 No 28 s 8(1), (5) Exemption for personal information relating to personal or domestic affairs IPPs 1 to 3 and 4(b) do not apply to an agency if that agency— (a) is an individual; and (b) is collecting personal information solely for the purposes of, or in con- nection with, his or her personal or domestic affairs.
(2) IPPs 5 to 11 do not apply to an agency if that agency— (a) is an individual; and 10 15 20 25 (b) is holding personal information that was collected by a lawful means solely for the purposes of, or in connection with, his or her personal or domestic affairs.
(3) However, the exemptions in subsections (1) and (2) do not apply if— 30 (a) (b) the personal information is, or was, collected by engaging in misleading or deceptive conduct, or conduct likely to mislead or deceive; or the collection, use, or disclosure of the personal information would be highly offensive to a reasonable person.
Compare: 1993 No 28 s 56 35 28 Privacy Bill Part 3 cl 27 25 Exemption for intelligence and security agencies IPPs 2, 3, and 4(b) do not apply to information collected by an intelligence and security agency.
Compare: 1993 No 28 s 57 26 (1) Certain personal information exempt from IPPs 6 and 7 IPPs 6 and 7 do not apply in respect of— (a) personal information during transmission by post or electronic means; or (b) personal information that is contained in any correspondence or commu- nication between an agency and any of the following persons and that re- lates to an investigation conducted by that person under any Act, not being information that was in existence before the commencement of the investigation: 5 10 (i) (ii) (iii) (iv) an Ombudsman: any officer or employee appointed by the Chief Ombudsman under section 11(1) of the Ombudsmen Act 1975: 15 the Commissioner: any employee or delegate of the Commissioner; or (c) personal information held by the Auditor-General, the Deputy Auditor- General, or any employee of the Auditor-General in connection with the performance or exercise of the Auditor-General’s functions, duties, or powers; or 20 (d) personal information contained in evidence given or submissions made to— (i) (ii) (iii) a government inquiry, until the final report of that inquiry is pre- sented to the appointing Minister: 25 a public inquiry (including a Royal commission), until the final report of that inquiry is presented to the House of Representatives: a person or body appointed under any Act to inquire into a speci- fied matter; or (e) personal information contained in a video record made under the Evi- dence Regulations 2007 or any copy or transcript of the video record.
30 IPP 7 does not apply to personal information collected by Statistics New Zea- land under the Statistics Act 1975.
Compare: 1993 No 28 ss 7(5), 55 Commissioner may authorise collection, use, storage, or disclosure of personal information otherwise in breach of IPP 2, 9, 10, or 11 35 (2) 27 (1) An agency may apply to the Commissioner for authorisation to do any of the following in the circumstances of a particular case: 29 Part 3 cl 27 Privacy Bill (a) (b) (c) (d) collect personal information even if the collection of that information would otherwise be in breach of IPP 2: keep personal information even if the keeping of that information would otherwise be in breach of IPP 9: use personal information even if the use of that information would other- wise be in breach of IPP 10: disclose personal information even if the disclosure of that information would otherwise be in breach of IPP 11.
(2) An application under subsection (1) must be made in the manner required by the Commissioner.

(3) (4) (5) (6) If, on receiving an application, the Commissioner is not satisfied that the appli- cant has taken sufficient steps to give notice of the application to all individuals concerned, the Commissioner may require the applicant to give public notice of the application in a manner that the Commissioner specifies.
If, on receiving an application, the Commissioner is not satisfied that the appli- cant has given sufficient opportunity to individuals concerned to object to the application, the Commissioner may require the applicant to give any further opportunity that the Commissioner specifies.

In considering whether to grant an authorisation, the Commissioner must take into account any objections to the application received from individuals con- cerned.
The Commissioner may grant an authorisation sought by an applicant only if the Commissioner is satisfied that, in the special circumstances of the case,— 5 10 15 20 (a) the public interest in granting the authorisation outweighs, to a substan- tial degree, the possibility of— 25 (i) (ii) (iii) any loss, detriment, damage, or injury to the individuals con- cerned; or any adverse affect on the rights, benefits, privileges, obligations, or interests of the individuals concerned; or any significant humiliation, significant loss of dignity, or signifi- cant injury to the feelings of the individuals concerned; or 30 (b) granting the authorisation would result in a clear benefit to the individu- als concerned that outweighs the possibility of— (i) (ii) (iii) any loss, detriment, damage, or injury to the individuals con- cerned; or 35 any adverse affect on the rights, benefits, privileges, obligations, or interests of the individuals concerned; or any significant humiliation, significant loss of dignity, or signifi- cant injury to the feelings of the individuals concerned.
30 Privacy Bill Part 3 cl 30 (7) The Commissioner may not grant an authorisation under subsection (6) in re- spect of any specified personal information if the individual concerned objec- ted.

(8) An authorisation granted under subsection (6) may be given subject to any conditions that the Commissioner thinks fit.

5 (9) 28 (1) (2) The Commissioner must maintain on the Commissioner’s Internet site a list of current authorisations granted under this section.
Compare: 1993 No 28 s 54 Enforceability of IPPs Except as provided in subsection (2), the IPPs do not confer on any person any right that is enforceable in a court of law.

10 The entitlements conferred on an individual by IPP 6(1), to the extent that those entitlements relate to personal information held by a public sector agency, are legal rights and are enforceable in a court of law.
Compare: 1993 No 28 s 11 15 Subpart 2—Public register privacy principles 29 Interpretation In this subpart, unless the context otherwise requires,— public register means any register, roll, list, or other document maintained under a public register provision 20 public register provision means a provision specified in the second column of Schedule 2 as a public register provision of an enactment specified in the first column of that schedule.
Compare: 1993 No 28 s 58 30 Public register privacy principles 25 The public register privacy principles are as follows: Public register privacy principle 1 Search references Personal information must be made available from a public register only by search references that are consistent with the manner in which the register is indexed or organised.
31 Part 3 cl 31 Privacy Bill Public register privacy principle 2 Use of information from public registers Personal information obtained from a public register must not be re-sorted, or combined with personal information obtained from any other public register, for the purpose of making available for valuable consideration personal infor- mation assembled in a form in which that personal information could not be obtained directly from the register.
Public register privacy principle 3 Electronic transmission of personal information from register Personal information in a public register must not be made available by means of electronic transmission unless the purpose of the transmission is to make the information available to a member of the public who wishes to search the register.
Public register privacy principle 4 Charging for access to public register Personal information must be made available from a public register for no charge or for no more than a reasonable charge.

31 (1) Compare: 1993 No 28 s 59 Compliance with PRPPs The agency responsible for administering a public register must, in administer- ing the register, comply so far as is reasonably practicable with the PRPPs.
(2) A person that is not an agency responsible for administering a public register 5 must, so far as is reasonably practicable, comply with PRPP 2.

Compare: 1993 No 28 s 60(1), (2) 32 Relationship between PRPPs and other laws If a PRPP is inconsistent with any enactment, then, to the extent that it is in- consistent, the enactment prevails.

10 Compare: 1993 No 28 s 60(3) 33 Enforceability of PRPPs The PRPPs do not confer on any person any right that is enforceable in a court of law.
Compare: 1993 No 28 s 62 15 32 Privacy Bill Part 3 cl 35 34 Power to amend Schedule 2 by Order in Council The Governor-General may, by Order in Council made on the recommendation of the responsible Minister given after consultation with the Commissioner, amend Schedule 2 by inserting any item.

Compare: 1993 No 28 s 65(1) Subpart 3—Codes of practice 35 (1) Codes of practice in relation to IPPs The Commissioner may at any time issue a code of practice in relation to the IPPs.
(2) A code of practice may— (a) modify the application of 1 or more of the IPPs by— (i) (ii) prescribing more stringent or less stringent standards: exempting any action from an IPP, either unconditionally or con- ditionally: (b) (c) apply 1 or more of the IPPs without modification: prescribe how 1 or more of the IPPs are to be applied or complied with.
(3) A code of practice may apply in relation to 1 or more of the following: (a) (b) (c) (d) any specified information or class or classes of information: any specified agency or class or classes of agency: any specified activity or class or classes of activity: any specified industry, profession, or calling or class or classes of indus- try, profession, or calling.
(4) A code of practice may also— (a) (b) (c) (d) (e) impose, in relation to any private sector agency, controls in relation to the comparison (whether done manually or by means of any electronic or other device) of personal information with other personal information for the purpose of producing or verifying information about an identifia- ble individual: in relation to charging under section 72,— (i) set guidelines to be followed by agencies in determining charges: (ii) prescribe circumstances in which no charge may be imposed: prescribe procedures for dealing with complaints alleging a breach of the code, without limiting or restricting any provision of Part 5: provide for the review of the code by the Commissioner: provide for the expiry of the code.
(5) A code of practice may not limit or restrict the entitlements under IPP 6 or 7.
33 Part 3 cl 36 Privacy Bill (6) Despite the definition of the term individual in section 6,— (a) (b) a sector-specific code of practice may be issued that applies 1 or more of the IPPs to information about deceased persons (whether or not the code also applies 1 or more of the IPPs to other information); and the code of practice has effect under section 43 as if those IPPs so ap- plied, and the provisions of this Act apply accordingly.
5 36 (1) Compare: 1993 No 28 s 46 Codes of practice in relation to public registers The Commissioner may at any time issue, in relation to any public register, a code of practice.
10 (2) A code of practice issued under this section may— (a) modify the application, in relation to a public register, of 1 or more of the PRPPs, or 1 or more of the IPPs, or both, by— (i) (ii) prescribing more stringent or less stringent standards: exempting any action from a PRPP or an IPP, either uncondition- ally or conditionally: 15 (b) prescribe how 1 or more of the PRPPs, or 1 or more of the IPPs, or both, are to be applied or complied with: (c) impose requirements that are not prescribed by any PRPP.
(3) A code of practice issued under this section may also provide for— 20 (a) (b) the review of the code by the Commissioner: the expiry of the code.

Compare: 1993 No 28 s 63(1)–(3) 37 Relationship between codes and other law If a code of practice is inconsistent with any enactment, then, to the extent that it is inconsistent, the enactment prevails.
25 Compare: 1993 No 28 s 63(4) Issue of code of practice The Commissioner may issue a code of practice under section 35 or 36 on— (a) the Commissioner’s own initiative; or 30 38 (1) (b) the application of any person.
(2) An application may be made under subsection (1)(b) only— (a) (b) by a body that represents the interests of any class or classes of agency, industry, profession, or calling (a group); and if the code of practice sought by the applicant is intended to apply to that group, or any activity of the group.
35 34 Privacy Bill Part 3 cl 40 (3) Before issuing a code of practice, the Commissioner must— (a) give public notice of the Commissioner’s intention to issue the code and include a statement that— (i) (ii) the details of the proposed code, including a draft of the proposed code, may be obtained from the Commissioner; and 5 submissions on the proposed code may be made in writing to the Commissioner within the period specified in the notice; and (b) do everything reasonably possible to advise all persons affected by the proposed code, or the representatives of those persons, of— (i) (ii) the details of the proposed code; and the reasons for the proposed code; and (c) give the persons affected by the code, or the representatives of those per- sons, the opportunity to make submissions on the proposed code; and (d) consider any submissions made on the proposed code.
Publication in the Gazette of a notice under subsection (3)(a) is conclusive proof that the requirements of that provision have been complied with in re- spect of the code of practice to which the notice relates.
Compare: 1993 No 28 ss 47(1), (3), (4); 48(1), (2) Urgent issue of code of practice If the Commissioner considers that it is necessary to issue a code of practice, or to amend or revoke any code of practice, and that following the procedure set out in section 38(3) would be impracticable because it is necessary to issue the code or, as the case may be, the amendment or revocation urgently, the Commissioner may issue the code of practice or, as the case may be, the amendment or revocation without complying with that procedure.
(4) 39 (1) (2) Every code of practice, and every amendment or revocation of a code of prac- tice, issued in accordance with this section— (a) must be identified as a temporary code or amendment or revocation; and (b) remains in force for the period (not exceeding 1 year after the date of its issue) specified for that purpose in the code or, as the case may be, the amendment or the revocation.
(3) Nothing in section 40(2) applies in respect of a code of practice, or any amendment or revocation of a code of practice, issued in accordance with this section.
Compare: 1993 No 28 s 52 40 (1) Notification, availability, and commencement of code If a code of practice is issued under section 35 or 36,— 10 15 20 25 30 35 35 Part 3 cl 41 Privacy Bill (a) the Commissioner must ensure that there is published in the Gazette, as soon as practicable after the code is issued, a notice that— (i) (ii) states that the code has been issued; and specifies a place at which copies of the code are available for in- spection free of charge and for purchase; and 5 (b) the Commissioner must ensure that, so long as the code remains in force, the code is publicly available on an Internet site maintained by or on be- half of the Commissioner, and that copies of the code are available— (i) (ii) for inspection by members of the public free of charge; and for purchase by members of the public at a reasonable price.
10 (2) Every code of practice must come into force on the 28th day after the date of its notification in the Gazette or on any later day that is specified in the code.

Compare: 1993 No 28 s 49 41 Application of Legislation Act 2012 to codes All codes of practice are disallowable instruments, but not legislative instru- ments, for the purposes of the Legislation Act 2012 and must be presented to the House of Representatives under section 41 of that Act.
15 Compare: 1993 No 28 s 50 Amendment and revocation of codes The Commissioner may at any time issue an amendment or a revocation of a code of practice.

20 The provisions of sections 38, 40, and 41 apply in respect of any amend- ment or revocation of a code of practice.
Compare: 1993 No 28 s 51 Effect of code If a code of practice issued under section 35 is in force,— (a) any action that would otherwise be a breach of an IPP is, for the pur- poses of Part 5, treated as not breaching that IPP if the action complies with the code; and (b) failure to comply with the code, even if the failure would not otherwise be a breach of any IPP, is, for the purposes of Part 5, treated as breach- ing an IPP.
If a code of practice issued under section 36 is in force, the doing of any ac- tion that would otherwise be a breach of a PRPP or an IPP is, for the purposes of Part 5, treated as not breaching that IPP or PRPP if the action is done in compliance with the code.
If a code of practice issued under section 36 modifies a PRPP and is in force, failure to comply with the code, even if the failure would not otherwise be a 25 30 35 42 (1) (2) 43 (1) (2) (3) 36 Privacy Bill Part 4 cl 47 breach of any PRPP, is, for the purposes of Part 5, treated as breaching an PRPP.
(4) If a code of practice issued under section 36 modifies an IPP and is in force, failure to comply with the code, even if the failure would not otherwise be a breach of any IPP, is, for the purposes of Part 5, treated as breaching an IPP.
Compare: 1993 No 28 ss 53, 64 5 Part 4 Access to and correction of personal information Subpart 1—Access to personal information 44 (1) Interpretation 10 In this subpart and subpart 3, access request means— (a) a request made under IPP 6(1)(a) to confirm that an agency holds per- sonal information about a requestor; or (b) a request made under IPP 6(1)(b) to access personal information held by an agency about the requestor; or 15 (c) a request made under IPP 6(1)(a) and (b).
(2) In this subpart, requestor, in relation to an access request, means the individual who makes the request.

45 Individuals may make access request An access request may be made only by a requestor who is an individual.

20 Compare: 1993 No 28 s 34 46 Urgency (1) A requestor may ask that an access request be treated as urgent (an urgent ac- cess request).

(2) A requestor making an urgent access request must state why the request should 25 be treated as urgent.
(3) On receiving an urgent access request, an agency must consider the request and the reason stated for its urgency when determining the priority to be given to responding to it.

Compare: 1993 No 28 s 37 47 Assistance Every agency must give reasonable assistance to an individual who— (a) (b) wishes to make an access request; or is making an access request.
Compare: 1993 No 28 s 38 30 35 37 Part 4 cl 48 Privacy Bill 48 (1) (2) Transfer of access request This section applies if an agency that receives an access request— (a) (b) does not hold the information to which the request relates, but believes that the information is held by another agency; or believes that the request is more closely connected with the functions or activities of another agency.
5 The agency must promptly, and in any case not later than 10 working days after the day on which the access request is received, transfer the request to the other agency and inform the requestor accordingly.

(3) However, subsection (2) does not apply if the agency has good cause to be- lieve that the requestor does not want the request transferred to another agency.
10 (4) If, in reliance on subsection (3), the agency does not transfer the request, the agency must promptly, and in any case not later than 10 working days after the day on which the access request was received, inform the requestor that— (a) (b) (c) this section applies in respect of the request; and in reliance on subsection (3), the request has not been transferred; and the name of the agency to which the request could be transferred.
Compare: 1993 No 28 s 39 49 Decision on access request under IPP 6(1)(a) (1) On receiving an access request made under IPP 6(1)(a) that is not transferred under section 48, an agency must, as soon as is reasonably practicable, and in any case not later than 20 working days after the day on which the request is received, give or send to the requestor a response to the request.
(2) A response must— 15 20 (a) (b) (c) confirm that the agency holds personal information about the requestor; or 25 confirm that the agency does not hold personal information about the re- questor; or state that the agency neither confirms nor denies that it holds personal information about the requestor.
30 (3) A response under subsection (2)(c) may be given only if,— (a) (b) had the request been made under IPP 6(1)(b), the agency would have relied on section 52(1)(a)(i) or (d), 54, 55, or 57(b) to refuse to dis- close information, or refuse to disclose information if it existed; and the agency is satisfied that, had the request been made under IPP 6(1)(b), the interest protected by any of those provisions would have been likely to be prejudiced by the agency confirming whether or not it held personal information about the requestor.
35 Compare: 1993 No 28 ss 32, 40(1) 38 Privacy Bill Part 4 cl 51 50 Decision on access request under IPP 6(1)(b) (1) On receiving an access request made under IPP 6(1)(b) that is not transferred under section 48, an agency must, as soon as is reasonably practicable, and in any case not later than 20 working days after the day on which the request is received, give or send to the requestor a response to his or her request.
5 (2) A response must notify the requestor that— (a) access to the information, or some of the information, requested is gran- ted, and state— (i) (ii) the way the information is to be made available; and the charge (if any) payable under section 72 in respect of the re- quest, and whether all or part of that charge is required to be paid in advance; or 10 (b) (c) access to the information, or some of the information, requested is re- fused; or the agency neither confirms nor denies that it holds the information, or some of the information, requested.
15 (3) A response under subsection (2)(b) may be given only if the agency is able to rely on any of sections 52 to 57 to refuse access to the information.
(4) A response under subsection (2)(c) may be given only if the agency— (a) (b) is able to rely on sections 52(1)(a)(i) or (d), 54, 55, or 57(b) to re- fuse to disclose the information or refuse to disclose the information if it existed; and is satisfied that the interest protected by any of those provisions would be likely to be prejudiced by the agency confirming whether or not it holds personal information about the requestor.
(5) If an agency decides that a charge is payable in respect of a request, the agency must, at the same time as notifying the requestor of that decision, notify the re- questor of his or her right to make a complaint to the Commissioner in respect of the charge.

(6) After giving a response under subsection (2)(a) and receiving any charge re- quired to be paid in advance, the agency must make available to the requestor the information requested.
20 25 30 Compare: 1993 No 28 ss 30, 32, 40(1), (2) 51 Extension of time limits (1) On receiving an access request, an agency may extend the time limit set out in 35 section 48, 49, or 50 in respect of the request if— (a) the request necessitates a search through a large quantity of information, and meeting the original time limit would unreasonably interfere with the operations of the agency; or 39 Part 4 cl 52 Privacy Bill (b) (c) consultations necessary to make a decision on the request are such that a response to the request cannot reasonably be given within the original time limit; or the processing of the request raises issues of such complexity that a re- sponse to the request cannot reasonably be given within the original time limit.
5 (2) Any extension under subsection (1) must be for a reasonable period of time having regard to the circumstances.

(3) The extension is effected by giving notice of the extension to the requestor within 20 working days after the day on which the request is received.
10 (4) The notice effecting the extension must— (a) (b) (c) specify the period of the extension; and give the reasons for the extension; and state that the requestor has the right to make a complaint to the Commis- sioner about the extension; and 15 (d) contain any other information that may be necessary.
Compare: 1993 No 28 s 41 52 Protection, etc, of individual as reason for refusing request under IPP 6(1)(b) (1) An agency may refuse access to any information requested under IPP 6(1)(b) 20 if— (a) the disclosure of the information would— (i) (ii) be likely to endanger the safety of any individual; or create a significant likelihood of serious harassment of an indi- vidual; or 25 (iii) include disclosure of information about another person who— (A) is the victim of an offence or alleged offence; and (B) would be caused significant distress, loss of dignity, or in- jury to feelings by the disclosure of the information; or (b) after consultation is undertaken (where practicable) by or on behalf of the agency with the requestor’s health practitioner, the agency is satis- fied that— (i) (ii) the information relates to the requestor; and the disclosure of the information (being information that relates to the physical or mental health of the requestor) would be likely to prejudice the physical or mental health of the requestor; or 30 35 (c) in the case of a requestor under the age of 16, the disclosure of that in- formation would be contrary to the requestor’s interests; or 40 Privacy Bill Part 4 cl 53 (d) the disclosure of that information (being information in respect of a re- questor who has been convicted of an offence or is or has been detained in custody) would be likely to prejudice the safe custody or the rehabili- tation of the requestor.
(2) In this section,— health practitioner means— (a) (b) a medical practitioner within the meaning of section 5(1) of the Health Practitioners Competence Assurance Act 2003; or a person who is, or is deemed to be, registered with an authority appoin- ted by or under the Health Practitioners Competence Assurance Act 2003 as a practitioner of a particular health profession and whose scope of practice includes the assessment of a person’s mental capacity victim has the meaning given to it in section 8 of the Prisoners’ and Victims’ Claims Act 2005.
Compare: 1993 No 28 ss 27(1)(d), 29(1)(c), (d), (e), (4) 53 Evaluative material as reason for refusing request under IPP 6(1)(b) (1) An agency may refuse access to any information requested under IPP 6(1)(b) if— (a) the information is evaluative material and the disclosure of that informa- tion or of the information identifying the person who supplied it would breach an express or implied promise— (i) (ii) that was made to the person who supplied the information; and that was to the effect that the information or the identity of the person who supplied it, or both, would be held in confidence; or (b) the information is evaluative material that was made available by the agency to another agency, and that other agency may refuse to disclose the information under paragraph (a).
(2) In this section, evaluative material— (a) means evaluative or opinion material compiled by an agency solely— (i) for the purpose of determining the suitability, eligibility, or quali- fications of the individual to whom the material relates— 30 (A) (B) (C) (D) for employment or for appointment to office; or for promotion in employment or office or for continuance in employment or office; or for removal from employment or office; or 35 for the awarding of contracts, awards, scholarships, hon- ours, or other benefits; or 41 Part 4 cl 54 Privacy Bill (ii) (iii) for the purpose of determining whether any contract, award, scholarship, honour, or benefit should be continued, modified, or cancelled; or for the purpose of deciding whether to insure any individual or property or to continue or renew the insurance of any individual or property; but 5 (b) does not include any evaluative or opinion material described in para- graph (a) that is compiled by a person employed or engaged by the agency in the ordinary course of that person’s employment or duties.
Compare: 1993 No 28 s 29(1)(b), (3) 10 54 Security, defence, international relations as reason for refusing request under IPP 6(1)(b) An agency may refuse access to any information requested under IPP 6(1)(b) if the disclosure of the information would be likely— (a) (b) to prejudice the security or defence of New Zealand or the international relations of the Government of New Zealand; or 15 to prejudice the entrusting of information to the Government of New Zealand on a basis of confidence by— (i) the Government of any other country or any agency of the Gov- ernment of any other country; or 20 (ii) any international organisation; or (c) to prejudice the security or defence of— (i) (ii) the self-governing State of the Cook Islands; or the self-governing State of Niue; or (iii) Tokelau; or (iv) the Ross Dependency; or (d) to prejudice relations between any of the Governments of— (i) (ii) New Zealand: the self-governing State of the Cook Islands: (iii) the self-governing State of Niue; or (e) to prejudice the international relations of the Government of— (i) (ii) the self-governing State of the Cook Islands; or the self-governing State of Niue.
Compare: 1993 No 28 s 27 25 30 42 Privacy Bill Part 4 cl 57 55 Trade secret as reason for refusing request under IPP 6(1)(b) (1) An agency may refuse access to any information requested under IPP 6(1)(b) if the information needs protecting because making the information available would— (a) (b) disclose a trade secret; or be likely to unreasonably prejudice the commercial position of the per- son who supplied the information or who is the subject of the informa- tion.
(2) Subsection (1) does not apply if, in the circumstances of the particular case, the withholding of that information is outweighed by other considerations that make it desirable, in the public interest, to make the information available.
5 10 Compare: 1993 No 28 s 28 56 Administrative reasons for refusing request under IPP 6(1)(b) An agency may refuse access to any information requested under IPP6(1)(b) if— 15 (a) (b) the information requested is not readily retrievable; or the information requested does not exist or, despite reasonable efforts to locate it, cannot be found; or (c) the information requested is not held by the agency.
Compare: 1993 No 28 s 29(2) 20 57 Other reasons for refusing request under IPP 6(1)(b) An agency may refuse access to any information requested under IPP 6(1)(b) if— (a) the disclosure of the information would involve the unwarranted disclos- ure of the affairs of— 25 (i) (ii) another individual; or a deceased person; or (b) the disclosure of the information would be likely to prejudice the main- tenance of the law, including— (i) (ii) the prevention, investigation, and detection of offences; and 30 the right to a fair trial; or (c) (d) the disclosure of the information would breach legal professional privil- ege; or in the case of a request made to Radio New Zealand Limited or Televi- sion New Zealand Limited, the disclosure of the information would be likely to reveal the source of information of a bona fide news media journalist, and— 35 (i) the information is subject to an obligation of confidence; or 43 Part 4 cl 58 Privacy Bill (ii) the disclosure of the information would be likely to prejudice the supply of similar information, or information from the same source; or (e) (f) the disclosure of the information, being information contained in mater- ial placed in any library or museum or archive, would breach a condition subject to which that material was placed; or 5 the disclosure of the information would constitute contempt of court or of the House of Representatives; or (g) the request is made by a defendant or a defendant’s agent and is— (i) (ii) for information that could be sought by the defendant under the Criminal Disclosure Act 2008; or 10 for information that could be sought by the defendant under that Act and that has been disclosed to, or withheld from, the defend- ant under that Act; or (h) (i) the agency has reasonable grounds for believing that the request was made under duress; or 15 the request is frivolous or vexatious, or the information requested is triv- ial.
Compare: 1993 No 28 ss 27(1)(c), 29(1)(a), (f)–(j) 58 (1) (2) 59 (1) Agency may impose conditions instead of refusing access to information under section 57 This section applies if an agency has good reason under any of sections 52 to 57 to refuse access to any information requested under IPP 6(1)(b).
Instead of refusing access to information requested under IPP 6(1)(b), the agency may grant access to the information, but may impose conditions relat- ing to either or both of the following: (a) (b) the requestor’s use of the information: the requestor’s disclosure of the information to any other person.
Requestor to be informed of certain matters if response given under section 49(2)(c) or 50(2)(c) This section applies if an agency responds to a request under IPP 6(1)(a) or (b) by stating that the agency neither confirms nor denies that it holds personal information about the requestor.

(2) The agency must inform the requestor of— the reason for the response; and the requestor’s right to make a complaint to the Commissioner in respect of that response.
(a) (b) 44 20 25 30 35 Privacy Bill Part 4 cl 61 (3) The agency must also disclose to the requestor the grounds in support of the reason for the response if the requestor has requested disclosure of the grounds.

(4) However, subsection (3) does not apply if disclosing the grounds would prejudice the interests protected by any of sections 52(1)(a)(i) and (d), 54, 55, and 57(b).
Compare: 1993 No 28 s 44 60 (1) (2) Requestor to be informed of certain matters if request under IPP 6(1)(b) refused This section applies if an agency refuses access to information requested under IPP 6(1)(b).

The agency must inform the requestor of— (a) (b) the reason for the refusal; and the requestor’s right to make a complaint to the Commissioner in respect of the refusal.
5 10 (3) The agency must also disclose to the requestor the grounds in support of the reason for the refusal if— 15 (a) (b) the reason is that set out in section 53(1)(a); or the reason is not that set out in section 53(1)(a), but the requestor has requested disclosure of the grounds.
(4) However,— (a) (b) (c) subsection (3)(a) does not apply if disclosing the grounds would prejudice the interests protected by section 53(1)(a): subsection (3)(b) does not apply if disclosing the grounds would prejudice the interests protected by any of sections 52, 54, and 57(e) to (i): subsection (3)(b) does not apply if disclosing the grounds would prejudice the interests protected by section 55 and the withholding of those grounds is not outweighed by other considerations that make it de- sirable, in the public interest, to disclose them.
Compare: 1993 No 28 s 44 61 Withholding information requested under IPP 6(1)(b) contained in document (1) If the information requested under IPP 6(1)(b) is contained in a document and there is good reason under any of sections 52 to 57 for withholding some of that information, the agency may decide to grant the requestor access to a copy of that document under section 50(2) with any deletions or alterations in re- spect of the information that could be withheld that it considers necessary.
(2) If information is withheld under subsection (1), the agency must inform the requestor of— 20 25 30 35 45 Part 4 cl 62 Privacy Bill (a) (b) the reason for the decision to withhold the information; and the requestor’s right to make a complaint to the Commissioner in respect of that decision.
(3) The agency must also disclose to the requestor the grounds in support of the reason for the decision to withhold the information if— 5 (a) (b) the reason is that set out in section 53(1)(a); or the reason is not that set out in section 53(1)(a), but the requestor has requested disclosure of the grounds.
(4) However,— (a) (b) (c) subsection (3)(a) does not apply if disclosing the grounds would prejudice the interests protected by section 53(1)(a): subsection (3)(b) does not apply if disclosing the grounds would prejudice the interests protected by any of sections 52, 54, and 57(e) to (i): subsection (3)(b) does not apply if disclosing the grounds would prejudice the interests protected by section 55 and the withholding of those grounds is not outweighed by other considerations that make it de- sirable, in the public interest, to disclose them.
Compare: 1993 No 28 s 43 62 Ways information may be made available (1) If the information requested by an individual under IPP 6(1)(b) is in a docu- ment, that information may be made available in 1 or more of the following ways: 10 15 20 (a) (b) (c) (d) (e) (f) by giving the requestor a reasonable opportunity to inspect the docu- ment; or 25 by providing the requestor with a copy of the document; or in the case of a document that is an article or a thing from which sounds or visual images are capable of being reproduced, by making arrange- ments for the requestor to hear or view the sounds or visual images; or in the case of a document by which words are recorded in a manner in which they are capable of being reproduced in the form of sound or in which words are contained in the form of shorthand writing or in codi- fied form, by providing the requestor with a written transcript of the words recorded or contained in the document; or 30 by giving an excerpt or a summary of the document’s contents; or 35 by giving oral information about the document’s contents.
(2) Subject to section 61, the agency must make the information available in the way preferred by the requestor unless to do so would— (a) impair the efficient administration of the agency; or 46 Privacy Bill Part 4 cl 66 (b) be contrary to any legal duty of the agency in respect of the document.
(3) If the information is not provided in the way preferred by the requestor, the agency must give to the requestor— (a) (b) the reason for not providing the information in that way; and if the requestor so requests, the grounds in support of that reason.
5 Compare: 1993 No 28 s 42 63 Responsibilities of agency before giving access to information If information is requested under IPP 6(1)(b), the agency— (a) may give access to the information only if the agency is satisfied of the identity of the requestor; and 10 (b) must ensure, by the adoption of appropriate procedures, that any infor- mation intended for a requestor is received— (i) (ii) only by that requestor; or if the request is made by a requestor as agent for an individual, only by the requestor or the individual; and 15 (c) must ensure that, if the request is made by a requestor as agent for an individual, the requestor has the written authority of the individual to ob- tain the information, or is otherwise properly authorised by the individu- al to obtain the information.
64 (1) Compare: 1993 No 28 s 45 Subpart 2—Correction of personal information Interpretation In this subpart and subpart 3, correction request means— (a) a request made under IPP 7(1)(a) to correct information; or a request made under IPP 7(2)(b) to attach a statement of correction to personal information.

(b) 20 25 (2) In this subpart, requestor, in relation to a correction request, means the indi- vidual who made the request.
65 Individuals may make correction requests A correction request may be made only by a requestor who is an individual.

30 Compare: 1993 No 28 s 34 66 Urgency (1) A requestor may ask that a correction request be treated as urgent (an urgent correction request).

(2) A requestor making an urgent correction request must state why the request 35 should be treated as urgent.
47 5 10 Part 4 cl 67 Privacy Bill (3) On receiving an urgent correction request, an agency must consider the request and the reason stated for its urgency when determining the priority to be given to responding to it.

Compare: 1993 No 28 s 37 67 Assistance Every agency must give reasonable assistance to an individual who— (a) (b) wishes to make a correction request; or is making a correction request.
Compare: 1993 No 28 s 38 Transfer of correction request 68 (1) (2) This section applies if an agency that receives a correction request— (a) (b) does not hold the information to which the request relates, but believes that the information is held by another agency; or believes that the request is more closely connected with the functions or activities of another agency.
15 The agency must promptly, and in any case not later than 10 working days after the day on which the correction request is received, transfer the request to the other agency and inform the individual who made the request accordingly.
Compare: 1993 No 28 s 39 69 Decision on request under IPP 7(1)(a) (1) On receiving a correction request made under IPP 7(1)(a) that is not transfer- red under section 68, an agency must as soon as is reasonably practicable, and in any case not later than 20 working days after the day on which the re- quest is received,— (a) (b) decide whether to grant the request; and give or send to the requestor a response to the request.
(2) A response must notify the requestor that— 20 25 (a) the request has been granted, and of the steps that will be taken to cor- rect the information; or (b) the request has not been granted and state the reason, and that— 30 (i) (ii) the requestor may, if he or she has not done so already, provide to the agency a statement of the correction sought with a request under IPP 7(2)(b); and the requestor has the right to make a complaint to the Commis- sioner in respect of the refusal to grant the request.
35 (3) If an agency decides to grant a request, the agency must take any steps to cor- rect the information that are in the circumstances reasonable to ensure that, 48 70 (1) (2) Privacy Bill Part 4 cl 71 having regard to the purposes for which the information may lawfully be used, the information is accurate, up to date, complete, and not misleading.
Compare: 1993 No 28 ss 6 (IPP 7(2)), 40(1) Decision on request under IPP 7(2)(b) This section applies if an agency— (a) (b) does not grant a correction request made under IPP 7(1)(a); and receives a correction request under IPP 7(2)(b) that is not transferred under section 68.
The agency must as soon as is reasonably practicable, and in any case not later than 20 working days after the day on which the correction request made under IPP 7(2)(b) is received,— (a) take any steps that are reasonable in the circumstances to attach the statement of correction to the information in such a manner that it will always be read with the information; and (b) inform the requestor— (i) (ii) that steps have been taken to attach the statement of correction to the information, and what those steps are; or that no steps have been taken to attach the statement of correction to the information.
Compare: 1993 No 28 ss 6 (IPP 7(3)), 40 71 Extension of time limits (1) On receiving a correction request, an agency may extend the time limit set out in section 68, 69, or 70 in respect of the request if— (a) the request necessitates a search through a large quantity of information, and meeting the original time limit would unreasonably interfere with the operations of the agency; or (b) consultations necessary to make a decision on the request are such that a response to the request cannot reasonably be given within the original time limit.
(2) Any extension under subsection (1) must be for a reasonable period of time, 30 having regard to the circumstances.

(3) The extension is effected by giving notice of the extension to the requestor within 20 working days after the day on which the request is received.
(4) The notice effecting the extension must— (a) (b) (c) specify the period of the extension; and give the reasons for the extension; and 35 state that the requestor has the right to make a complaint to the Commis- sioner about the extension; and 49 Part 4 cl 72 Privacy Bill (d) contain any other information that may be necessary.
Compare: 1993 No 28 s 41 Subpart 3—Charges 72 Charges (1) An agency may not impose a charge for— (a) (b) (c) (d) (e) (f) receiving an access request; or transferring an access request to another agency; or processing an access request; or receiving a correction request; or transferring a correction request; or processing a correction request.
5 10 (2) An agency may impose a charge for providing assistance in accordance with section 47 or 67 if the agency— (a) is a private sector agency; and (b) makes information available in compliance, in whole or in part, with a 15 request under IPP 6(1)(a) or (b).
(3) A private sector agency, and a public sector agency authorised under section 73 to do so, may impose a charge for— (a) making information available in compliance, in whole or in part, with a (b) request under IPP 6(1)(b): attaching a statement of correction to personal information in compli- ance with a request under IPP 7(2)(b).
(4) A charge imposed under subsection (2) or (3) must be reasonable, and in the case of a charge imposed under subsection (3)(a) may reflect— (a) the cost of the labour and materials involved in making the information available; and (b) in the case of an urgent access request received under section 46, any costs involved in making the information available urgently.

(5) An agency may require all or part of a charge to be paid in advance.
Compare: 1993 No 28 ss 35(1)–(5), 40(2) Commissioner may authorise public sector agency to impose charge If the conditions in subsection (2) are satisfied, the Commissioner may authorise a public sector agency to impose a charge for— (a) (b) granting, in whole or in part, an access request under IPP 6(1)(b): attaching a statement of correction to personal information in compli- ance with a request under IPP 7(2)(b).
73 (1) 50 20 25 30 35 Privacy Bill Part 5 cl 74 (2) The conditions are that— (a) the request is received from, or on behalf of, an individual who— (i) (ii) is residing outside New Zealand; and is not a New Zealand citizen or permanent resident of New Zea- land; or 5 (b) the Commissioner is satisfied that the public sector agency would other- wise be commercially disadvantaged, in comparison with any competitor in the private sector.
(3) (4) The Commissioner may impose any conditions on an authorisation given under subsection (1) that the Commissioner thinks fit.

The Commissioner may, at any time, revoke an authorisation given under sub- section (1), but only after giving the agency an opportunity to be heard.
Compare: 1993 No 28 s 36 Part 5 Complaints, investigations, and proceedings 74 Interpretation In this Part, unless the context otherwise requires,— action has the meaning given to it by section 6, and includes a decision aggrieved individual means an individual whose privacy is the subject of— (a) (b) a complaint under subpart 1: an investigation under subpart 2 10 15 20 approved information sharing agreement has the meaning given to it by section 138 complainant, in relation to a complaint, means the individual who made the complaint 25 information matching agreement means an agreement entered into under section 178 parties,— (a) in relation to an investigation conducted by the Commissioner on receiv- ing a complaint under section 78(1), means— (i) the complainant whose complaint is the subject of the investiga- tion; and 30 (ii) (iii) the aggrieved individual (if not the complainant); and the respondent: (b) in relation to an investigation conducted by the Commissioner on his or her own initiative, means— 35 51 Part 5 cl 75 Privacy Bill (i) (ii) the aggrieved individual (if known); and the respondent public register complaint means a complaint that— 10 15 20 (a) (b) (c) (d) a public register provision is inconsistent with 1 or more of the IPPs or PRPPs; or 5 an agency responsible for administering a public register is not, in the administration of that register, complying with— (i) (ii) the IPPs; or the PRPPs; or (iii) both the IPPs and the PRPPs; or an agency is not complying with PRPP 2; or an agency is not complying with a code of practice issued under sec- tion 36 public register provision has the meaning given to it in section 29 respondent means an agency whose action is the subject of an investigation under subpart 2.
Compare: 1993 No 28 ss 55, 61(1), (3), 64(b) 75 Interference with privacy of individual (1) In this Act, an action of an agency is an interference with the privacy of an individual in any of the circumstances set out in subsection (2) or (3).
(2) An action of an agency is an interference with the privacy of an individual if the action breaches,— (a) in relation to the individual,— (i) (ii) (iii) (iv) 1 or more of the IPPs; or the provisions of an approved information sharing agreement; or 25 the provisions of an information matching agreement or section 179 or 181; or section 119; and (b) the action— (i) (ii) (iii) has caused, or may cause, loss, detriment, damage, or injury to the individual; or 30 has adversely affected, or may adversely affect, the rights, bene- fits, privileges, obligations, or interests of the individual; or has resulted in, or may result in, significant humiliation, signifi- cant loss of dignity, or significant injury to the feelings of the indi- vidual.
35 52 5 10 15 20 Privacy Bill Part 5 cl 77 (3) An action of an agency is an interference with the privacy of an individual if, in relation to a request made by an individual under subpart 1 or 2 of Part 4, the agency has— (a) made a decision that has no proper basis to refuse to grant a request under IPP 6; or (b) made a decision that has no proper basis to refuse to grant a request under IPP 7; or (c) made any other decision under Part 4 that has no proper basis in rela- tion to the request.
For the purpose of subsection (3)(a), the following must be treated as a deci- sion by an agency to refuse to grant a request under IPP 6: (a) a failure to comply with the time limits in Part 4 for responding to the request: (b) undue delay in making information available after granting the request.
For the purpose of subsection (3)(b), the following must be treated as a deci- sion by an agency to refuse to grant a request under IPP 7: (a) a failure to comply with the time limits in Part 4 for responding to the request: (b) undue delay in correcting information after granting the request.
Compare: 1993 No 28 s 66 Types of complaints Subpart 1—Complaints (4) (5) 76 (1) The following types of complaints may be made under this Part: (a) a complaint alleging that an action of an agency is, or appears to be, an interference with the privacy of an individual: 25 (b) a public register complaint.

(2) A complaint may be made together with 1 or more other complaints of the same or of a different type.
77 Who may make complaint (1) A complaint may be made by— (a) (b) an aggrieved individual; or a representative of 1 or more aggrieved individuals.

(2) A representative referred to in subsection (1)(b) may, but need not, be an ag- grieved individual.

Compare: 1993 No 28 s 67(1) 30 35 53 Part 5 cl 78 Privacy Bill 78 Form of complaint (1) A complaint must be made to the Commissioner and may be made orally or in writing.

(2) A complaint made orally must be put in writing as soon as practicable.
(3) If a person wishing to make a complaint to the Commissioner requires assist- ance to put the complaint in writing, the Commissioner must give that person any assistance that is reasonably necessary in the circumstances.
5 Compare: 1993 No 28 ss 67(2), 68 79 Procedure on receipt of complaint (1) As soon as practicable after receiving a complaint, the Commissioner must 10 consider the complaint and— (a) (b) (c) (d) (e) decide, in accordance with section 80, not to investigate the complaint; or decide, in accordance with section 81, to defer taking action on the complaint; or 15 decide, in accordance with section 82, to refer the complaint to another person; or decide, in accordance with section 83, to refer the complaint, or part of the complaint, to an overseas privacy enforcement authority; or decide, in accordance with section 84, to explore the possibility of se- curing a settlement between the complainant and the agency whose ac- tion is the subject of the complaint; or (f) decide to investigate the complaint in accordance with subpart 2.
(2) As soon as practicable after making a decision under subsection (1), the Commissioner must— (a) advise the complainant of that decision; and (b) advise the complainant of reasons for the decision, if the decision is made under subsection (1)(a), (b), or (c).
Compare: 1993 No 28 ss 70, 71(3), 72(3), 72A(3), 72B(3), 72C(3) 80 Commissioner may decide not to investigate complaint The Commissioner may decide not to investigate a complaint if, in the Com- missioner’s opinion,— (a) (b) the complainant has not made reasonable efforts to resolve the complaint directly with the agency concerned; or there is an alternative dispute resolution process available to the com- plainant because of the agency’s membership of a particular profession or industry; or 54 20 25 30 35 Privacy Bill Part 5 cl 82 (c) (d) (e) (f) (g) (h) (i) (j) there is an adequate remedy or right of appeal, other than the right to pe- tition the House of Representatives or to make a complaint to an Om- budsman, that it would be reasonable for the aggrieved individual to pur- sue; or the complaint relates to a matter in respect of which a code of practice has been issued that includes a complaints procedure, and the complai- nant has not taken reasonable steps to pursue, or fully pursue, the redress available under that procedure; or 5 the complainant knew about the action that is the subject of the com- plaint for 12 months or more before making the complaint; or 10 the time that has elapsed between the date on which the subject of the complaint arose and the date on which the complaint was made is such that an investigation of the complaint is no longer practicable or desira- ble; or the aggrieved individual does not want the complaint pursued; or 15 the complainant does not have a sufficient personal interest in the subject of the complaint; or the subject of the complaint is trivial; or the complaint is frivolous, vexatious, or not made in good faith.
Compare: 1993 No 28 s 71(1) 20 81 Commissioner may decide to defer taking action on complaint The Commissioner may decide to defer taking action on a complaint if— (a) (b) the complainant has not complained to the agency concerned; and the Commissioner considers that the complainant should do so in an at- tempt to directly resolve the complaint.
25 82 (1) Referral of complaint to another person This section applies if, on receiving a complaint (not being a public register complaint), the Commissioner considers that the complaint relates, in whole or in part, to a matter that is more properly within the jurisdiction of any of the following persons: (a) (b) (c) (d) an Ombudsman; or the Health and Disability Commissioner; or the Inspector-General of Intelligence and Security; or the Independent Police Conduct Authority.
(2) As soon as practicable, the Commissioner must— 30 35 (a) consult the person specified in subsection (1) who the Commissioner considers has jurisdiction to deal with the complaint; and (b) decide the appropriate means of dealing with the complaint.
55 Part 5 cl 83 Privacy Bill (3) 83 (1) If the Commissioner decides that the complaint should be dealt with, in whole or in part, by a person specified in subsection (1), the Commissioner must, as soon as practicable, refer the complaint, or the appropriate part of the com- plaint, to that person.
Compare: 1993 No 28 ss 72, 72A, 72B Referral of complaint to overseas privacy enforcement authority This section applies if, on receiving a complaint (not being a public register complaint), the Commissioner considers that the complaint relates, in whole or in part, to a matter that is more properly within the jurisdiction of an overseas privacy enforcement authority.
(2) As soon as practicable, the Commissioner may— (a) consult the overseas privacy enforcement authority and the complainant; and (b) decide the appropriate means of dealing with the complaint.

(3) If the Commissioner decides that the complaint should be dealt with, in whole or in part, by the overseas privacy enforcement authority and both the authority and the complainant agree, the Commissioner may refer the complaint, or the appropriate part of the complaint, to the authority.
Compare: 1993 No 28 s 72C 84 Exploring possibility of settlement and assurance before investigating complaint (1) At any time after receiving a complaint and before commencing an investiga- tion, the Commissioner may decide to use his or her best endeavours to— (a) (b) secure a settlement of the complaint; and if appropriate, secure a satisfactory assurance from the agency whose ac- tion is the subject of the complaint that there will not be a repetition of the action that gave rise to the complaint, or of any similar kind of ac- tion.
(2) After using his or her best endeavours under subsection (1), the Commis- sioner may refer a complaint to the Director without conducting an investiga- tion if— (a) (b) (c) the Commissioner is unable to secure a settlement or a satisfactory assur- ance; or it appears that a term of settlement previously secured between the agency and the complainant has not been complied with; or 35 it appears that the action that is the subject of the complaint was done in contravention of any term of settlement or an assurance previously se- cured under this Act or the Privacy Act 1993.
Compare: 1993 No 28 ss 74, 77(2)(c) 56 Privacy Bill Part 5 cl 87 Subpart 2—Investigations by Commissioner 85 Application of this subpart This subpart applies to investigations conducted by the Commissioner— (a) (b) into complaints received under section 78(1); or on his or her own initiative, in relation to any matter in respect of which a complaint may be made under this Act.
5 86 Commencing investigation (1) As the first step of an investigation, the Commissioner must notify the follow- ing persons that he or she is commencing an investigation: (a) the aggrieved individual, if that individual— (i) (ii) is known; and is not a complainant who has been advised of a decision under section 79(2)(a); and (b) the respondent.
(2) A notice given under subsection (1)(b) must set out— (a) the details of— (i) (ii) the complaint; or the subject of the investigation; and 10 15 (b) the right to provide, within a reasonable time, a written response to the Commissioner.
20 Compare: 1993 No 28 s 73 87 Exploring possibility of settlement and assurance during investigation (1) At any time during an investigation of a complaint, the Commissioner may de- cide to use his or her best endeavours to— (a) (b) secure a settlement of the complaint; and if appropriate, secure a satisfactory assurance from the agency whose ac- tion is the subject of the complaint that there will not be a repetition of the action that gave rise to the complaint, or of any similar kind of ac- tion.
(2) At any time during an investigation being conducted on the Commissioner’s own initiative, the Commissioner may decide to use his or her best endeavours to secure a satisfactory assurance from the respondent that there will not be a repetition of the action that gave rise to the investigation, or of a similar kind of action.
(3) After using his or her best endeavours under subsection (1) or (2), the Com- missioner may refer the complaint or the matter that is the subject of the inves- tigation to the Director without conducting any further investigation if— 25 30 35 57 Part 5 cl 88 Privacy Bill (a) (b) (c) the Commissioner is unable to secure a settlement or a satisfactory assur- ance; or it appears that a term of settlement previously secured between the agency and the complainant has not been complied with; or it appears that the action that is the subject of the complaint or that gave rise to the investigation was done in contravention of any term of settle- ment or an assurance previously secured under this Act or the Privacy Act 1993.
Compare: 1993 No 28 ss 74, 77(1), (2) Conducting investigation The Commissioner must conduct an investigation in a timely manner.

88 (1) (2) During an investigation, the Commissioner may— (a) hear and obtain information from any person; and (b) make any inquiries.
5 10 (3) At any time during an investigation, the Commissioner may decide to take no 15 further action on a complaint or matter if the Commissioner— (a) (b) is satisfied of any of the matters set out in section 80; or considers that any further action is unnecessary or inappropriate.

(4) As soon as practicable after making a decision under subsection (3), the Commissioner must notify the parties of that decision.
(5) It is not necessary for the Commissioner to hold any hearing, and no person is entitled as of right to be heard by the Commissioner.

(6) Any investigation held by the Commissioner must be conducted in private.

Compare: 1993 No 28 ss 71(2), 75, 90(1), (2) 89 Commissioner may regulate own procedure When conducting an investigation, the Commissioner may regulate his or her procedure as he or she thinks fit, subject to this Act and any regulations made under this Act.
Compare: 1993 No 28 s 90(3) 90 Compulsory conferences of parties to complaint (1) At any time during an investigation of a complaint, the Commissioner may call a conference of the parties— (a) by sending each of them a notice requesting their attendance at a speci- fied time and place; or (b) by any other means agreed by the parties.
(2) The objectives of a conference are— (a) to identify the matters in issue between the parties; and 20 25 30 35 58 Privacy Bill Part 5 cl 92 (b) to try to obtain agreement between the parties on the resolution of those matters in order to settle the complaint.

If a person fails to comply with a request under subsection (1) to attend a conference, the Commissioner may issue a summons requiring the person to at- tend a conference at a time and place specified in the summons.
5 Section 159 of the Criminal Procedure Act 2011 applies to a summons under this section as if it were a witness summons issued under that section.

This section does not apply in respect of the investigation of a public register complaint.

Compare: 1993 No 28 s 76 Power to summon persons The Commissioner may summon and examine on oath any person who the Commissioner considers is able to give information relevant to an investiga- tion, and may for that purpose administer an oath to the person.
Every examination by the Commissioner under subsection (1) is to be treated as a judicial proceeding within the meaning of section 108 of the Crimes Act 1981 (which relates to perjury).
(3) (4) (5) 91 (1) (2) (3) A person who is summoned by the Commissioner under this section is entitled to the same fees, allowances, and expenses as if the person were a witness in a court, and— (a) (b) the provisions of any regulations prescribing the fees, allowances, and expenses payable to persons giving evidence under the Criminal Proced- ure Act 2011 apply; and the Commissioner has the powers of a court under such regulations to fix or disallow, in whole or in part, or to increase, any amounts payable under the regulations.
Compare: 1993 No 28 s 91(1)–(3), (5) 10 15 20 25 92 (1) Power to require information and documents The Commissioner may by notice require any person to provide— (a) (b) any information in the person’s possession, or under the person’s control, that the Commissioner considers may be relevant to the investigation: 30 any documents or things in the person’s possession, or under the per- son’s control, that the Commissioner considers may be relevant to the in- vestigation.
(2) A person who receives a notice under subsection (1) must comply with that 35 notice as soon as practicable, but in no case later than— (a) (b) the date specified in the notice; or if no date is specified in the notice, the 20th working day after the date of receipt of the notice.
59 Part 5 cl 93 Privacy Bill (3) However, a person may request an extension of the time limit for complying with a notice received under subsection (1) if— (a) the requirement in the notice relates to, or necessitates a search through, a large quantity of information, documents, or things, and meeting the original time limit would unreasonably interfere with the operations of the agency; or 5 (b) (c) the consultations necessary before the requirement in the notice can be complied with are such that meeting the original time limit is unreasona- ble; or the complexity of the issues raised by the requirement in the notice is such that meeting the original time limit is unreasonable.
10 (4) A request under subsection (3) must be made to the Commissioner before the expiry of the date in subsection (2)(b) and specify— (a) the period of the extension sought; and (b) (c) the reasons for the extension; and any other relevant information.

15 (5) The Commissioner must grant a request made under subsection (3) if satis- fied that any of the grounds specified in that subsection are established.
Compare: 1993 No 28 ss 91(4), 92(1), (2), 93 93 Disclosure of information may be required despite obligation of secrecy 20 (1) A person who is bound by the provisions of an enactment to maintain secrecy in relation to, or not to disclose, any matter may be required to do the following even though compliance with that requirement would be in breach of the obli- gation of secrecy or non-disclosure: (a) (b) give evidence to, or answer questions put by, the Commissioner: 25 provide information, documents, or things to the Commissioner.
(2) Compliance with a requirement of this kind is not a breach of the relevant obli- gation of secrecy or non-disclosure or of the enactment by which that obliga- tion is imposed.
(3) However, the Commissioner may not require information, documents, or things 30 to be provided if— (a) the Prime Minister certifies that the giving of any information, docu- ment, or thing might prejudice— (i) (ii) the security or defence of New Zealand, or the international rela- tions of the Government of New Zealand; or 35 any interest protected by section 7 of the Official Information Act 1982 (which relates to the Cook Islands, Niue, Tokelau, and the Ross Dependency); or 60 Privacy Bill Part 5 cl 94 (b) the Attorney-General certifies that the giving of any information, docu- ment, or thing— (i) might prejudice the prevention, investigation, or detection of offences; or (ii) might involve the disclosure of proceedings of Cabinet, or any committee of Cabinet, relating to matters of a secret or confiden- tial nature, and the disclosure would be injurious to the public in- terest.
This section is subject to section 94.

Compare: 1993 No 28 s 95 5 10 Protection and privileges of persons required to provide information, etc Every person has the same privileges as witnesses have in a court of law, in relation to— (a) (b) giving evidence to, or answering questions put by, the Commissioner: providing information, documents, or things to the Commissioner.
15 (4) 94 (1) (2) However, if the Commissioner issues a notice under section 92 in relation to a particular complaint under IPP 6 and the person who receives the notice claims privilege over any information, document, or thing, that person must nevertheless provide to the Commissioner the information, document, or thing that is the subject of the complaint for the purpose of the Commissioner deter- mining whether it is properly withheld from the aggrieved individual.
(3) When any information, document, or thing is provided under subsection (2), the Commissioner must not— (a) (b) (c) use the information, document, or thing other than for the purpose speci- fied in subsection (2); or take into account the information or any information in the document or thing in forming an opinion about the release of any other information; or give his or her opinion as to whether the claim of privilege is valid to any person other than— 30 (i) (ii) (iii) (iv) (v) the complainant (if any): the aggrieved person: the respondent: the Director of Human Rights Proceedings: the Human Rights Review Tribunal; or 35 (d) release the information, document, or thing, or any information derived from the document or thing, to any person other than— 61 20 25 Part 5 cl 95 Privacy Bill (i) (ii) (iii) any lawyer engaged by the Commissioner for the purpose of pro- viding legal advice as to whether the information, document, or thing would be properly withheld under subsection (1); or the Director of Human Rights Proceedings, if the Commissioner has given an opinion to the Director under paragraph (c)(iv); or the Human Rights Review Tribunal, if the Commissioner is re- quired to provide a report or information under section 114(1).
(4) (5) Subsection (3)(c) does not prevent the Commissioner from giving, either generally or to a particular person, an opinion in a form that does not iden- tify— (a) (b) the person who provided the information, document, or thing; and a person who is the subject of the information, document, or thing.
Subsection (3)(d) does not prevent the Commissioner from giving the infor- mation, document, or thing, or any information derived from the document or thing, to a person if— (a) (b) the person who provided the information, document, or thing consents; and the person who is the subject of the information, document, or thing con- sents.

5 10 15 (6) The privileges protected by this section do not include public interest immunity (see section 209).
20 (7) A person who complies with any requirement of the Commissioner under sec- tion 92 or 93 is not liable to prosecution for an offence against any enactment (other than section 212) in respect of that compliance.
Compare: 1993 No 28 s 94 95 Disclosed information privileged (1) Any information, document, or thing provided by a person in the course of an investigation by the Commissioner, or during any hearing before the Commis- sioner, is privileged in the same manner as if the investigation or hearing were proceedings in a court.
(2) The following persons may not be required to give evidence in any court, or in any proceedings of a judicial nature, in respect of anything coming to their knowledge in performing or exercising their functions, duties, or powers under this Act: 25 30 (a) (b) the Commissioner, or any person who has held the appointment of Com- missioner: 35 a person who is employed or engaged, or who has been employed or en- gaged, by the Commissioner: (c) the Director.
62 Privacy Bill Part 5 cl 96 (3) Subsection (2) does not apply in respect of proceedings for— (a) an offence against section 78, 78AA(1), 78A(1), 105, 105A, or 105B of the Crimes Act 1961; or (b) (c) the offence of conspiring to commit an offence against section 78, 78AA(1), 78A(1), 105, 105A, or 105B of the Crimes Act 1961; or 5 the offence of attempting to commit an offence against section 78, 78AA(1), 78A(1), 105, 105A, or 105B of the Crimes Act 1961.
(4) 96 (1) For the purposes of clause 3 of Part 2 of Schedule 1 of the Defamation Act 1992, any report of the Commissioner under this Act is taken to be an official report.

Compare: 1993 No 28 s 96 Procedure after completion of investigation relating to breach of IPP 6 This section applies after the Commissioner has completed an investigation of an action of an agency under subpart 1 of Part 4 that appears to be an inter- ference with the privacy of an individual.
(2) The Commissioner may,— (a) in the case of an investigation conducted on a complaint, make a deter- mination that the complaint— (i) (ii) has substance; or does not have substance; or (b) in the case of an investigation conducted on his or her own initiative, make a determination that the matter that is the subject of the investiga- tion— (i) (ii) should be proceeded with; or should not be proceeded with.
(3) (4) (5) If the Commissioner determines that a complaint has substance, the Commis- sioner must use his or her best endeavours to secure a settlement of the com- plaint and an assurance of the kind specified in section 87(1).

If the Commissioner determines that the matter that is the subject of an investi- gation should be proceeded with, the Commissioner must use his or her best endeavours to secure an assurance of the kind specified in section 87(2).
If the complaint or matter has not been resolved despite the Commissioner using his or her best endeavours, the Commissioner may do 1 or more of the following: (a) make any direction that the Commissioner considers appropriate that re- quires an agency to provide an individual access to his or her personal information: (b) refer the complaint or matter, as the case may be, to the Director: 10 15 20 25 30 35 63 Part 5 cl 97 Privacy Bill (c) take any other action that the Commissioner considers appropriate.
(6) Without limiting subsection (5)(a) or (b), the Commissioner may determine that a complaint has substance, or that the matter that is the subject of an inves- tigation should be proceeded with, if the action that is the subject of the com- plaint or investigation was done in contravention of any term of settlement or assurance previously secured under this Act or the Privacy Act 1993.
5 (7) Without limiting subsection (5)(a), the Commissioner may direct an agency to do any of the following before a specified date: (a) confirm whether or not the agency holds any specified personal informa- tion: 10 (b) permit any complainant access to specified information: (c) make specified information available to any complainant in a particular way.
(8) As soon as practicable, the Commissioner must give notice to the parties of— any determination made, or not made, under subsection (2) and the reasons for making or not making that determination; and 15 (a) (b) (c) (d) (e) any direction made under subsection (5)(a); and any referral made under subsection (5)(b); and any other action taken under subsection (5)(c); and any determination made under subsection (6).
(9) An agency may, under section 110, appeal to the Tribunal against a direction made under subsection (5)(a).
97 (1) Procedure after completion of investigation relating to charging This section applies after the Commissioner has completed an investigation of an action of an agency under subpart 3 of Part 4 that appears to be an inter- ference with the privacy of an individual because in relation to a request made by the individual under subpart 1 or 2 of Part 4 the agency has imposed a charge that is— (a) (b) contrary to section 72; or unreasonable.
(2) If it has not been possible to secure a settlement, the Commissioner may make a determination that the charge imposed by the agency is— (a) (b) (c) (d) properly imposed: improperly imposed: reasonable: unreasonable.

64 20 25 30 35 Privacy Bill Part 5 cl 98 (3) If the Commissioner makes a determination under subsection (2)(d), the Commissioner may also determine the appropriate charge for the agency to im- pose.
(4) As soon as practicable, the Commissioner must notify the parties to any deter- mination made, or not made, under subsection (2) or (3).

(5) A determination made by the Commissioner under subsection (2) is final and binding and no proceedings may be commenced in the Tribunal by the parties in respect of that determination.
(6) If the Commissioner makes a determination under subsection (3) and the agency does not agree to reduce the charge it has imposed to the amount deter- mined by the Commissioner to be appropriate (or less), the aggrieved individu- al may commence proceedings in the Tribunal complaining that the action of the agency is an interference with the privacy of an individual because it breaches IPP 6.
Compare: 1993 No 28 ss 75, 78 5 10 15 98 Procedure after completion of investigation relating to public register (1) After completing an investigation into whether a public register provision is in- consistent with an IPP or PRPP, the Commissioner must— (a) report his or her findings to the Minister responsible for the administra- tion of the provision that is the subject of the investigation; and 20 (b) provide a summary of the report to the complainant (if any).
(2) After completing an investigation into whether an agency responsible for ad- ministering a public register is not, in administering that register, complying with the IPPs, or the PRPPs, or both the IPPs and PRPPs, the Commissioner must— (a) report his or her findings to the agency whose actions were the subject of the investigation; and (b) provide a summary of the report to the complainant (if any).
(3) After completing an investigation into whether the action of an agency is in- consistent with PRPP 2, or a code of practice issued under section 36, the Privacy Commissioner must— (a) report his or her findings to the agency whose actions were the subject of the investigation; and (b) provide a summary of the report to the complainant (if any).
(4) A report referred to in subsection (1)(a), (2)(a), or (3)(a) may include rec- ommendations on the need for, or desirability of, taking any legislative, admin- istrative, or other action to ensure adherence, or greater adherence, to the IPPs or PRPPs, or both.
25 30 35 Compare: 1993 No 28 s 61 65 Part 5 cl 99 Privacy Bill 99 Procedure after completion of other investigations (1) After the Commissioner has completed an investigation under this subpart, other than an investigation to which section 96, 97, or 98 applies, the Com- missioner may,— (a) in the case of an investigation conducted on receiving a complaint, make a determination that the complaint— 5 (i) (ii) has substance; or does not have substance; or (b) in the case of an investigation conducted on his or her own initiative, make a determination that the subject of the investigation— 10 (i) (ii) should be proceeded with; or should not be proceeded with.
(2) (3) (4) If the Commissioner determines that a complaint has substance, the Commis- sioner must use his or her best endeavours to secure a settlement of the com- plaint and an assurance of the kind specified in section 87(1).

If the Commissioner determines that a matter that is the subject of an investiga- tion should be proceeded with, the Commissioner must use his or her best en- deavours to secure an assurance of the kind specified in section 87(2).
If the complaint or matter has not been resolved despite the Commissioner using his or her best endeavours, the Commissioner may do either or both of the following: (a) (b) refer the complaint or the matter, as the case may be, to the Director: take any other action the Commissioner considers appropriate.
(5) Without limiting subsection (4)(a) or (b), the Commissioner may determine that a complaint has substance, or that the matter that is the subject of an inves- tigation should be proceeded with, if the action that is the subject of the com- plaint or investigation was done in contravention of any term of settlement or assurance previously secured under this Act or the Privacy Act 1993.
(6) As soon as practicable, the Commissioner must notify the parties to the investi- gation of— (a) (b) (c) any determination made, or not made, under subsection (1); and any referral made under subsection (4)(a); and any other action taken under subsection (4)(b).
Compare: 1993 No 28 ss 75, 77(1), (2) 100 Special procedure relating to intelligence and security agency (1) Nothing in section 90, 96, 97, or 99 or subpart 3 applies to— (a) any complaint made under this Part in relation to an action of an intelli- gence and security agency; or 15 20 25 30 35 66 Privacy Bill Part 5 cl 102 (b) any investigation conducted under this Part in relation to an action of an intelligence and security agency.
(2) If, after completing an investigation, the Commissioner is of the opinion that an action of an intelligence and security agency is an interference with the privacy of an individual, the Commissioner must provide to the intelligence and secur- ity agency a report setting out— (a) (b) his or her opinion; and the reasons for that opinion.

(3) A report provided under subsection (2) may include any recommendations that the Commissioner considers appropriate.
(4) When making a report under subsection (2), the Commissioner may request the intelligence and security agency to notify him or her within a specified time of any steps the agency proposes to take in response to the report and to any recommendations included in the report.
(5) If, within a reasonable time after any report is made, the intelligence and secur- ity agency has taken no steps in response to the report that the Commissioner considers to be adequate and appropriate, the Commissioner may send a copy of the report to the Prime Minister.

(6) As soon as practicable after receiving a report under subsection (5), the Prime Minister may present the report, or any part of the report, to the House of Representatives.
Compare: 1993 No 28 s 81 101 Commissioner to report breach of duty or misconduct If, during or after an investigation, the Commissioner is of the opinion that there is evidence of any significant breach of duty or misconduct on the part of an agency, or an officer, an employee, or a member of an agency, the Commis- sioner must refer the matter to the appropriate authority.
Compare: 1993 No 28 s 80 Subpart 3—Proceedings before Human Rights Review Tribunal Proceedings in relation to complaints or investigations 102 Director may commence proceedings in Tribunal (1) (2) This section applies if a complaint or matter is referred by the Commissioner to the Director under section 96(5)(b) or 99(4).
The Director must— (a) decide whether to commence proceedings in the Tribunal in respect of that complaint or matter; and 35 (b) give written notice to the following persons of his or her decision: 67 Part 5 cl 103 Privacy Bill (i) (ii) (iii) the complainant (if any); and the aggrieved individual (if known); and the agency whose action was the subject of the Commissioner’s investigation.

(3) Before commencing any proceedings in the Tribunal, the Director must give the agency an opportunity to be heard.
5 (4) The parties to proceedings commenced under this section are— (5) (6) (a) (b) the Director, as the plaintiff; and the agency, as the defendant.

The aggrieved individual may join, or be joined in, the proceedings only if the Tribunal orders.
10 The Director may bring proceedings on behalf of a class of individuals, and may seek on behalf of individuals who belong to the class any of the remedies described in section 107, if the Director considers that a respondent is carry- ing on a practice that affects that class and that is an interference with the pri- vacy of an individual.
Compare: 1993 No 28 s 82 103 Aggrieved individual may commence proceedings in Tribunal (1) The aggrieved individual may commence proceedings in the Tribunal in re- spect of a complaint or matter investigated under subpart 2 in any case where— (a) (b) (c) (d) (e) (f) (g) (h) the Commissioner decides not to further investigate the complaint or matter; or the Commissioner does not make a determination on a complaint or matter; or 25 the Commissioner determines that the complaint does not have sub- stance, or that the matter should not be proceeded with; or the Commissioner determines that the complaint has substance, or the matter should be proceeded with, but does not refer the complaint or matter to the Director; or the Commissioner does not make a direction under section 96(5)(a); or the Commissioner makes a direction under section 96(5)(a) but the ag- grieved individual is not satisfied with the terms of that direction; or the Commissioner makes a determination under section 97(3) but the respondent does not comply with that determination and the aggrieved individual invokes section 97(6); or the Director decides not to commence proceedings in respect of a com- plaint or matter referred to him or her by the Commissioner; or 30 35 68 15 20 Privacy Bill Part 5 cl 104 (i) the Director notifies the aggrieved individual that he or she agrees to the aggrieved individual commencing proceedings in respect of a complaint or matter referred to the Director by the Commissioner.
(2) An aggrieved individual commencing proceedings under subsection (1)(a) must do so within 6 months after receiving the notice given by the Commis- sioner under section 88(4).

5 (3) An aggrieved individual commencing proceedings under subsection (1)(b) or (c) must do so within 6 months after receiving the notice given by the Com- missioner under section 96(8)(a) or 99(6)(a).
(4) An aggrieved individual commencing proceedings under subsection (1)(d) must do so within 6 months after receiving the notice given by the Commis- sioner under section 96(8) or 99(6).

(5) An aggrieved individual commencing proceedings under subsection (1)(e) or (f) must do so within 6 months after receiving the notice given by the Com- missioner under section 96(8).
(6) An aggrieved individual commencing proceedings under subsection (1)(g) must do so within 6 months after the refusal by an agency to impose a charge that does not exceed the appropriate amount determined by the Commissioner under section 97(3).

(7) An aggrieved individual commencing proceedings under subsection (1)(h) must do so within 6 months after receiving the notice given by the Director under section 102(2)(b).
(8) An aggrieved individual commencing proceedings under subsection (1)(i) must do so within 6 months after receiving the notice given by the Director under that subsection.

(9) The parties to proceedings commenced under this section are— (a) (b) the aggrieved individual, as the plaintiff; and the agency whose action was the subject of the Commissioner’s investi- gation, as the defendant.
Compare: 1993 No 28 s 83 10 15 20 25 30 104 Right of Director to appear in proceedings commenced under section 103 (1) In any proceedings commenced in the Tribunal under section 103, the Director may appear and be heard in person or by his or her lawyer— (a) (b) in the proceedings commenced in the Tribunal: in proceedings commenced in any court relating to the proceedings com- menced in the Tribunal.
35 (2) If the Director appears in any proceedings,— (a) the Director has the same rights as the parties to the proceedings to— (i) call evidence on any matter; and 69 Part 5 cl 105 Privacy Bill (ii) examine, cross-examine, and re-examine witnesses; and (b) the Tribunal or court may order— (i) (ii) any party to pay the costs incurred by the Director by reason of the Director’s appearance; or the Director to pay the costs incurred by any or all of the parties by reason of his or her appearance.
5 (3) If the Director declines to appear and be heard in any proceedings,— (a) (b) the Commissioner may instead appear and be heard in the proceedings; and subsection (2) applies to the Commissioner in the same way as it ap- plies to the Director.

10 (4) Nothing in this section limits or affects— (a) (b) section 107(3); or any power of a court to award costs in any proceedings to which the Director is a party.
Compare: 1993 No 28, s 86(1)–(3), (5), (6) 105 Apology not admissible except for assessment of remedies (1) If an apology is given by an agency in connection with an action alleged to be an interference with the privacy of an individual, it is not admissible as evi- dence in any civil proceedings against the agency under this Part except as pro- vided in subsection (2).

(2) An agency may bring evidence of the apology for the purpose of the Tribunal assessing remedies to be awarded against the agency.
106 Onus of proof Where any provision of this Act, or any code of practice issued under section 35 or 36, excepts or exempts any action from being an interference with the privacy of an individual, the defendant has the onus of proving that exception or exemption in any proceedings under this Part.
Compare: 1993 No 28 s 87 107 Remedies in respect of interference with privacy This section applies if proceedings are commenced in the Tribunal in respect of an action that is alleged to be an interference with the privacy of an individual.
If, in the proceedings, the Tribunal is satisfied on the balance of probabilities that any action of the defendant is an interference with the privacy of an indi- vidual, the Tribunal may grant 1 or more of the following remedies: (a) a declaration that the action of the defendant is an interference with the privacy of an individual: (1) (2) 70 15 20 25 30 35 5 10 15 20 Privacy Bill Part 5 cl 108 (b) (c) (d) an order restraining the defendant from continuing or repeating the inter- ference, or from engaging in, or causing or permitting others to engage in, conduct of the same kind as that constituting the interference, or con- duct of any similar kind specified in the order: damages in accordance with section 108: an order that the defendant perform any acts specified in the order with a view to remedying the interference, or redressing any loss or damage suffered by the aggrieved individual as a result of the interference, or both: (e) any other relief that the Tribunal thinks fit.
(3) It is not a defence to proceedings that the interference was unintentional or without negligence on the part of the defendant, but the Tribunal must take the conduct of the defendant into account in deciding what, if any, remedy to grant.
Compare: 1993 No 28 s 85(1), (4) 108 Damages (1) In any proceedings, the Tribunal may award damages against the defendant for an interference with the privacy of an individual in respect of 1 or more of the following: pecuniary loss suffered as a result of, and expenses reasonably incurred by the aggrieved individual for the purpose of the transaction or activity out of which the interference arose: loss of any benefit, whether or not of a monetary kind, that the aggrieved individual might reasonably have been expected to obtain but for the interference: (a) (b) (c) humiliation, loss of dignity, and injury to the feelings of the aggrieved individual.
25 (2) (3) (4) (5) (6) Subsection (1) is subject to subpart 1 of Part 2 of the Prisoners’ and Victims’ Claims Act 2005.

The Director must pay damages recovered under this section to the aggrieved individual on whose behalf the proceedings were brought.

30 Subsection (3) is subject to subsections (5) to (7).
If the aggrieved individual is a minor who is not married or not in a civil union, the Director may, in his or her discretion, pay the damages to Public Trust or to any person or trustee corporation acting as the manager of any property of the aggrieved individual.
If the aggrieved individual is a mentally disordered person within the meaning of section 2 of the Mental Health (Compulsory Assessment and Treatment) Act 1992 whose property is not being managed under the Protection of Personal and Property Rights Act 1988, the Director may, in his or her discretion, pay the damages to Public Trust.
35 40 71 Part 5 cl 109 Privacy Bill (7) If the aggrieved individual is a person whose property is being managed under the Protection of Personal and Property Rights Act 1988, the Director must as- certain whether the terms of the property order cover management of money received as damages and,— (a) (b) if damages fall within the terms of the property order, the Director must pay the damages to the person or trustee corporation acting as the prop- erty manager; or 5 if damages do not fall within the terms of the property order, the Director may, in his or her discretion, pay the damages to Public Trust.
(8) If money is paid to Public Trust under subsection (5), (6), or (7),— (a) sections 103 to 110 of the Contract and Commercial Law Act 2017 apply in the case of a minor who is not married or not in a civil union; and (b) (c) sections 108D, 108F, and 108G of the Protection of Personal and Proper- ty Rights Act 1988 apply, with any necessary modifications, in the case of a person referred to in subsection (6) or (7)(b); and section 108E of the Protection of Personal and Property Rights Act 1988 applies, with any necessary modifications, in the case of an individual referred to in subsection (7)(a).
Compare: 1993 No 28 s 88; 1994 No 88 s 57 Access orders 109 Enforcement of direction made by Commissioner under section 96(5)(a) after investigation of IPP 6 breach (1) (2) (3) In the circumstances specified in subclause (2), an aggrieved individual may apply to the Tribunal for an access order requiring an agency to comply with a direction made by the Commissioner under section 96(5)(a).
The circumstances are that the agency— (a) (b) has not complied with the direction; and has not lodged an appeal under section 110.

If the Tribunal grants an application, the Tribunal must specify in the access order the date by which the agency must comply with the direction made by the Commissioner under section 96(5)(a).

(4) An agency that, without reasonable excuse, fails to comply with an access order commits an offence and is liable on conviction to a fine not exceeding $10,000.
10 15 20 25 30 72 Privacy Bill Part 5 cl 114 Appeals against direction made after investigation of IPP 6 breach 110 Appeal to Tribunal against direction of Commissioner under section 96(5)(a) (1) An agency that has received notice of a direction made by the Commissioner under section 96(5)(a) after the completion of an investigation may appeal to the Tribunal against the direction.

5 (2) The parties to the appeal are the parties to the investigation.
111 Time for lodging appeal (1) An appeal under section 110 must be lodged with the Tribunal within 20 working days from the date of the notice given to the parties to the complaint under section 96(8) (the appeal period).

The Tribunal may accept an appeal lodged not later than 3 months after the ap- peal period if the Tribunal is satisfied that exceptional circumstances prevented the appeal from being lodged within the appeal period.
(2) 10 112 (1) Interim order suspending Commissioner’s direction pending appeal 15 The chairperson of the Tribunal may make an interim order suspending a direc- tion made by the Commissioner under section 96(5)(a) until an appeal is de- termined if the chairperson is satisfied that it is necessary and in the interests of justice to make the order.

(2) If an interim order is made, a party may apply to the High Court to vary or re- scind the order, unless the order was made with that party’s consent.
20 (3) An application under subsection (2) may be made only with the leave of the Tribunal.

(4) An application may be made instead of but not as well as an appeal against the interim order under section 123(1) of the Human Rights Act 1993.

25 113 Appeal may be determined on papers (1) (2) The Tribunal may determine an appeal on the papers if the Tribunal considers it appropriate.
Before doing so, the Tribunal must give the parties a reasonable opportunity to comment on whether the proceeding should be dealt with in that manner.

30 114 Determination of appeal (1) The Tribunal may require the Commissioner to provide either or both of the following: (a) (b) a written report setting out the considerations to which the Commis- sioner had regard in making the direction: 35 any information held by the Commissioner that is required to determine the appeal.
73 Part 5 cl 115 Privacy Bill (2) At the hearing of an appeal (other than an appeal determined on the papers), the Commissioner is entitled to appear in person, or by his or her representa- tive, and be heard.

(3) The Tribunal may determine an appeal by— (a) confirming the direction appealed against: (b) modifying the direction appealed against: (c) reversing the direction appealed against.

(4) The Tribunal may award damages in accordance with section 108.
Miscellaneous 115 Costs (1) (2) (3) In any proceedings under section 102, 103, 109, or 110, the Tribunal may award costs against either party whether or not it makes any other order.

If, in any proceedings before the Tribunal or a court, costs are ordered to be paid by the Director, those costs must be paid by the Commissioner.

The Commissioner is not entitled to be indemnified by the aggrieved individual in respect of any costs the Commissioner is required to pay under subsection (1).
Compare: 1993 No 28 ss 85(2), (3), 86(4) 116 Certain provisions of Human Rights Act 1993 to apply Sections 92Q to 92W and Part 4 of the Human Rights Act 1993 apply, with any necessary modifications, to proceedings under section 102, 103, 109, or 110 of this Act as if they were proceedings under the Human Rights Act 1993.
Compare: 1993 No 28 s 89 Part 6 Notifiable privacy breaches and compliance notices Subpart 1—Notifiable privacy breaches 117 (1) Interpretation In this subpart,— affected individual, in relation to personal information that is the subject of a privacy breach,— 30 (a) means the individual to whom the information relates; and (b) (c) includes an individual inside or outside New Zealand; and despite the definition of individual in section 6, includes a deceased person— 74 Privacy Bill Part 6 cl 119 (i) (ii) if a sector-specific code of practice issued under section 35 spe- cifies that the code applies to information about deceased persons; and to the extent that the code of practice applies 1 or more IPPs to that information 5 notifiable privacy breach means a privacy breach that has caused any of the types of harm listed in section 75(2)(b) to an affected individual or individu- als or there is a risk it will do so privacy breach, in relation to personal information held by an agency,— (a) means— (i) (ii) unauthorised or accidental access to, or disclosure, alteration, loss, or destruction of, the personal information; or an action that prevents the agency from accessing the information on either a temporary or permanent basis; and (b) includes any of the things listed in paragraph (a)(i) or an action under paragraph (a)(ii), whether or not it— (i) was caused by a person inside or outside the agency; or (ii) (iii) is attributable in whole or in part to any action by the agency; or is ongoing.
(2) For the purposes of this subpart, the meanings of access, disclosure, and loss are not limited by the use of those words or the meanings ascribed to them elsewhere in this Act.

Compare: 1956 No 65 s 22B 10 15 20 118 Agency to notify Commissioner of notifiable privacy breach An agency must notify the Commissioner as soon as practicable after becom- ing aware that a notifiable privacy breach has occurred.
25 119 Agency to notify affected individual or give public notice of notifiable privacy breach (1) An agency must notify an affected individual as soon as practicable after be- coming aware that a notifiable privacy breach has occurred, unless subsec- tion (2) or an exception in section 120 applies.

If it is not reasonably practicable to notify an affected individual or each mem- ber of a group of affected individuals, the agency must instead give public no- tice of the privacy breach.
(2) (3) Public notice must be given— (a) (b) in a form in which no affected individual is identified; and in accordance with any regulations made under section 213.
30 35 75 (a) (b) (c) (d) Part 6 cl 120 Privacy Bill (4) If subsection (2) or an exception in section 120 is relied on, the agency must notify the affected individual or individuals at a later time if— (a) (b) circumstances change so that subsection (2) or the exception no longer applies; and at that later time, there is or remains a risk that the privacy breach will cause any of the types of harm listed in section 75(2)(b) to the affected individual or individuals.
5 (5) A failure to notify an affected individual under this section may be an interfer- ence with privacy under this Act (see section 75(2)(a)(iv)).
120 Exceptions to obligations to notify affected individual or give public notice 10 of notifiable privacy breach (1) An agency is not required to notify an affected individual or give public notice of a notifiable privacy breach if the notification or notice would be likely to— prejudice the security or defence of New Zealand or the international re- lations of the Government of New Zealand; or 15 prejudice the maintenance of the law by any public sector agency, in- cluding the prevention, investigation, and detection of offences, and the right to a fair trial; or endanger the safety of any person; or reveal a trade secret.
20 25 (2) An agency is not required to notify an affected individual or give public notice of a notifiable privacy breach— (a) (b) if the individual is under the age of 16 and the agency is satisfied that the notification or notice would be contrary to that individual’s interests; or if, after consultation is undertaken by the agency with the individual’s health practitioner (where practicable), the agency is satisfied that the notification or notice would be likely to prejudice the physical or mental health of the individual.
(3) If an agency decides not to notify an affected individual for either of those rea- sons, the agency must— 30 (a) (b) (c) consider whether it would be appropriate to notify a representative in- stead of the individual (if a representative is known or can be readily identified); and before deciding whether to notify a representative, take into account the circumstances of both the individual and the privacy breach; and 35 if the agency decides it is appropriate to notify a representative and has identified a representative, notify that person.
(4) The agency must advise the Commissioner as soon as practicable if— 76 Privacy Bill Part 6 cl 121 (a) the agency relies on subsection (1) and does not notify an affected in- dividual or give public notice of the breach; or (b) the agency— (i) relies on subsection (2) and does not notify an affected indi- vidual or give public notice of the breach; and 5 (ii) cannot or decides not to notify a representative of that individual.
10 15 20 (5) In this section, representative,— (a) (b) for an affected individual under the age of 16, means his or her parent or guardian: for an affected individual aged 16 or over, means an individual appear- ing to be lawfully acting on that individual’s behalf or in that individu- al’s interests.
Compare: 1982 No 156 s 6 121 Requirements for notification (1) A notification to the Commissioner under section 118 must— (a) describe the notifiable privacy breach, including— (i) (ii) the number of affected individuals (if known); and the identity of any person or body that the agency suspects may be in possession of personal information as a result of the privacy breach (if known); and explain the steps that the agency has taken or intends to take in response to the privacy breach, including whether any affected individual has been or will be contacted; and if the agency is relying on section 119(2) to give public notice of the breach, set out the reasons for relying on that section; and 25 if the agency is relying on an exception to notification of affected indi- viduals in section 120, state the exception relied on and set out the rea- sons for relying on it; and state the names of any other agencies that the agency has contacted about the privacy breach and the reasons for having done so; and 30 (b) (c) (d) (e) (f) give details of a contact person within the agency for inquiries.
(2) A notification to an affected individual under section 119 or a representative under section 120(3) must— (a) describe the notifiable privacy breach and state whether the agency has or has not identified any person or body that the agency suspects may be in possession of the affected individual’s personal information (but must not include any particulars that could identify that person or body); and 35 77 Part 6 cl 122 Privacy Bill (b) (c) (d) (e) explain the steps taken or intended to be taken by the agency in response to the privacy breach; and where practicable, set out the steps the affected individual may wish to take to mitigate or avoid potential loss or harm (if any); and confirm that the Commissioner has been notified under section 118; and 5 state that the individual has the right to make a complaint to the Com- missioner; and (f) give details of a contact person within the agency for inquiries.
(3) A notification to an affected individual must not include any particulars about 10 any other affected individuals.

(4) In order to comply with the requirement under sections 118 and 119 that notification must be made as soon as practicable, an agency may provide the information required by this section incrementally.

However, any information that is available at any point in time must be provided as soon as practicable after that point in time.
122 Offence to fail to notify Commissioner (1) An agency that, without reasonable excuse, fails to notify the Commissioner of a notifiable privacy breach under section 118 commits an offence and is liable on conviction to a fine not exceeding $10,000.
(2) It is not a defence to a charge under this section that the agency— (a) did not consider the privacy breach to be a notifiable privacy breach, if, in the circumstances, it was reasonable for the agency to have done so; or (b) has taken steps to address the privacy breach.
15 20 25 123 Publication of identity of agencies in certain circumstances (1) The Commissioner may publish the identity of an agency that has notified the Commissioner of a notifiable privacy breach if— (a) (b) the agency consents to publication; or the Commissioner is satisfied that it is in the public interest to do so.
30 (2) This section does not prevent the publication of details of any notifiable priva- cy breach in a form in which the agency or any affected individual is not identi- fied and for the purpose of informing the public about the extent and nature of privacy breaches.
78 Privacy Bill Part 6 cl 125 Subpart 2—Compliance notices 124 Compliance notices (1) The Commissioner may issue a compliance notice to an agency if he or she considers that 1 or both of the following may have occurred: (a) (b) a breach of this Act, including an action listed in section 75(2)(a) or non-compliance with a PRPP: 5 an action that is to be treated as a breach of an IPP or an interference with the privacy of an individual under another Act.
(2) Before issuing a compliance notice, the Commissioner may, but is not required to,— 10 (a) (b) assess whether any person has suffered harm (for example, the types of harm listed in section 75(2)(b)): use other means under this Act or another Act for dealing with the breach.

(3) A compliance notice may be issued at any time, including concurrently with 15 the use of any other means for dealing with the breach.
Example The Commissioner issues a compliance notice while dealing with the same breach as a complaint under Part 5.
125 Issuing compliance notice (1) The Commissioner must consider the following factors before issuing a com- pliance notice: (a) (b) (c) (d) (e) whether there is another means under this Act or another Act for dealing with the breach: the seriousness of the breach: the likelihood of a repeat of the breach: the number of people who may be or are affected by the breach: whether the agency has been co-operative in all dealings with the Com- missioner: (f) the likely costs to the agency of complying with the notice.
(2) However, each of those factors need be considered only to the extent that— (a) (b) it is relevant in the Commissioner’s view: information about the factor is readily available to the Commissioner.
(3) Before issuing a compliance notice, the Commissioner must provide the agency concerned with a reasonable opportunity to comment on a written no- tice that— 20 25 30 35 79 Part 6 cl 126 Privacy Bill (a) (b) (c) (d) describes the breach, citing the relevant statutory provision or provi- sions; and summarises the conclusions reached about the factors in subsection (1) that have been considered by the Commissioner; and describes particular steps that the Commissioner considers need to be taken to remedy the breach (if any) and any conditions he or she con- siders appropriate (if any); and states the date or dates by which the Commissioner proposes that the agency must remedy the breach and report to the Commissioner (if any).
(4) In each case, the Commissioner must determine the period of time that will give the agency a reasonable opportunity to comment, taking into account the circumstances of the case.

(5) For the purpose of this subpart,— breach means any of the things described in section 124(1)(a) and (b): remedy the breach means to comply with the relevant statutory provision or provisions.
5 10 15 126 Form and service of compliance notice (1) A compliance notice issued to an agency must— (a) (b) (c) (d) (e) state the name of the agency; and describe the breach, citing the relevant statutory provision or provisions; and 20 require the agency to remedy the breach; and inform the agency of the right of appeal under section 131; and contain any other information required by any regulations made under section 213.
(2) A compliance notice issued to an agency may— (a) (b) (c) (d) identify particular steps that the Commissioner considers need to be taken by the agency to remedy the breach: include conditions that the Commissioner considers are appropriate: state the date or dates by which the agency must— (i) (ii) remedy the breach; and report to the Commissioner on the steps taken to do so: include other information that the Commissioner considers would be useful.
Compare: 1993 No 28 s 114D 80 25 30 35 Privacy Bill Part 6 cl 130 127 Agency response to compliance notice (1) An agency that is served with a compliance notice must take steps to comply with the notice, including taking any particular steps specified in the notice.
(2) The agency must do so as soon as practicable after receiving the compliance notice and must remedy the breach by the date stated in the notice unless that date is varied or modified, or the notice is cancelled or suspended, under this subpart.
5 128 Commissioner may vary or cancel compliance notice (1) The Commissioner may vary or cancel a compliance notice at any time if he or she considers that— 10 (a) (b) (c) any of the information listed in section 126 needs to be added to or amended in the notice; or all or part of the notice has been complied with; or all or part of the notice is no longer needed.

(2) The Commissioner must give written notice to the agency concerned of a deci- sion under this section.
15 (3) The notice must inform the agency of the right to appeal under section 131.

(4) A variation or cancellation of a compliance notice takes effect on the first working day after the day on which the notice of the decision is given to the agency.
Compare: 1993 No 28 s 114E 129 Commissioner’s power to obtain information (1) (2) (3) Before deciding whether to issue a compliance notice or to vary or cancel a compliance notice, the Commissioner may hear or obtain information from any person who the Commissioner considers may have relevant information.

Sections 90 to 94 apply as if the Commissioner were carrying out an investi- gation under Part 5.
Except as provided for in sections 90 to 94, the Commissioner may regulate his or her procedure as he or she thinks fit.
Compare: 1993 No 28 ss 90, 114C Proceedings 130 Enforcement of compliance notice 20 25 30 (1) The Commissioner may take enforcement proceedings in the Human Rights Review Tribunal— (a) if the time for an appeal under section 131 has passed and no appeal has been lodged against a compliance notice; and 35 (b) if— 81 Part 6 cl 131 Privacy Bill (i) (ii) the Commissioner has reason to believe that the agency has not remedied or will not remedy the breach by the date stated in the notice; or the agency has failed to report to the Commissioner on the steps taken to remedy the breach by the date stated in the notice.
5 (2) An agency may object to enforcement of a compliance notice only on the ground that the agency believes that the notice has been fully complied with.

(3) In proceedings under this section, the Tribunal— (a) must not examine or make any determination about the issuing or merits of a compliance notice: 10 (b) may examine and make a determination about whether a compliance no- tice has been fully complied with: (c) may order a remedy under section 133(1)(a).
Compare: 1988 No 110 s 45 131 Appeal against compliance notice or Commissioner’s decision under 15 section 128 (1) An agency that has been issued with a compliance notice may appeal to the Human Rights Review Tribunal— (a) against all or part of the notice; or (b) against a decision by the Commissioner under section 128.

(2) An appeal must be lodged within 15 working days from the day on which the compliance notice is issued or the notice of the decision is given to the agency.
The Tribunal may allow an appeal and order a remedy under section 133(1)(b) if it considers that— (a) the compliance notice or decision against which the appeal is brought is not in accordance with the law; or (b) to the extent that the compliance notice or decision involved an exercise of discretion by the Commissioner, the Commissioner ought to have exercised his or her discretion differently; or (c) the agency has fully complied with the compliance notice.
The Tribunal may review any determination of fact on which the compliance notice or decision was based.

The Tribunal must not cancel or modify a compliance notice for the reason that— (a) the breach was unintentional or without negligence on the part of the agency; or 35 20 25 30 (3) (4) (5) 82 Privacy Bill Part 6 cl 133 (b) the agency has taken steps to remedy the breach, unless there is no fur- ther reasonable step that the agency can take to do so.
Compare: 1993 No 28 s 114G 132 Interim order suspending compliance notice pending appeal (1) The Chairperson of the Tribunal may make an interim order suspending all or part of a compliance notice for a certain period until an appeal is determined if he or she is satisfied that it is necessary and in the interests of justice to make the order.

5 (2) If an interim order is made, a party may apply to the High Court to vary or re- scind the order, unless the order was made with that party’s consent.
10 (3) An application may be made to the High Court only with the leave of the Tri- bunal.

(4) An application may be made instead of, but not as well as, an appeal against the interim order under section 123(1) of the Human Rights Act 1993.
Compare: 1993 No 82 ss 95, 96 133 Remedies, costs, and enforcement (1) The Human Rights Review Tribunal may,— (a) in enforcement proceedings under section 130, grant 1 or more of the following remedies: (i) (ii) an order that the agency comply with a compliance notice by a date specified in the order (which may vary from the date origin- ally stated in the notice): an order that the agency perform any act specified in the order by a date specified in the order (for example, reporting to the Com- missioner on progress in complying with the compliance notice): 15 20 25 (b) in an appeal under section 131, grant 1 or more of the following rem- edies: (i) an order that confirms, cancels, or modifies the compliance no- tice; or (ii) an order that confirms, overturns, or modifies the decision: 30 (c) in either type of proceeding, award costs as the Tribunal thinks fit.
(2) An award of costs may, on registration of a certified copy of the Tribunal’s de- cision, be enforced in the District Court as if it were an order of that court.

(3) An agency that, without reasonable excuse, fails to comply with an order under subsection (1)(a) or with a compliance notice that is confirmed or modified under subsection (1)(b)(i) commits an offence and is liable on conviction to a fine not exceeding $10,000.
35 Compare: 1993 No 28 s 85; 1993 No 82 s 121 83 Part 6 cl 134 Privacy Bill 134 Application of Human Rights Act 1993 Except to the extent expressly modified by this subpart, Part 4 of the Human Rights Act 1993 (except sections 97, 108A, and 108B) applies to proceedings under this subpart with any necessary modifications.
Compare: 1993 No 28 s 114H 135 Commissioner may be represented in proceedings In proceedings under this subpart, the Commissioner is entitled to appear in person or to be represented by counsel or an agent.
Part 7 Sharing, accessing, and matching personal information Subpart 1—Information sharing 5 10 136 Purpose of this subpart The purpose of this subpart is to authorise agencies to share personal informa- tion in accordance with an authorised information sharing agreement to facili- tate the provision of public services.
15 Compare: 1993 No 28 s 96A 137 Relationship between subpart 1 and other law relating to information disclosure (1) To avoid doubt, nothing in this subpart— (a) (b) limits the collection, use, or disclosure of personal information that is authorised or required by or under any enactment; or 20 compels agencies to enter into an information sharing agreement if those agencies are already allowed to share personal information— (i) (ii) by or under any other enactment; or because an exemption from or a modification to 1 or more of the IPPs or any code of practice is not required to make the sharing of the information lawful.
(2) Without limiting subsection (1)(a),— (a) (b) this subpart does not limit section 22, 25, or 27; and this subpart and subparts 2 to 4 do not limit one another.
(3) An information sharing agreement may— 25 30 (a) duplicate an information sharing provision by providing for an agency to share the same personal information specified in the information sharing provision— (i) with the same agencies specified in the information sharing provi- sion; and 35 84 Privacy Bill Part 7 cl 138 (ii) for the same purposes specified in the information sharing provi- sion; or (b) extend an information sharing provision that is not a restricted informa- tion sharing provision by providing for an agency to share the same per- sonal information specified in the information sharing provision— 5 (i) with the same agencies specified in the information sharing provi- sion for a purpose not specified in the information sharing provi- sion; or (ii) with an agency not specified in the information sharing provision for a purpose specified in the information sharing provision; or 10 (iii) with an agency not specified in the information sharing provision and for a purpose not specified in the information sharing provi- sion; or (c) duplicate a restricted information sharing provision by providing for an agency to share the same personal information as specified in the restric- ted information sharing provision— 15 (i) (ii) with the same agencies specified in the restricted information sharing provision; and for the same purposes specified in the restricted information shar- ing provision; or 20 (d) extend in any manner specified in paragraph (b) a restricted informa- tion sharing provision, but only if— (i) (ii) the restricted information sharing provision is an information matching provision (as defined in section 178); or there is express statutory authorisation to do so.
(4) In subsection (3),— information sharing provision means a provision in any enactment other than this Act that authorises or requires the sharing of personal information by an agency with 1 or more other agencies for 1 or more specified purposes restricted information sharing provision means an information sharing pro- vision that expressly restricts the purposes for which the personal information may be shared to those purposes specified.
Compare: 1993 No 28 s 96B 138 Interpretation In this subpart, unless the context otherwise requires,— adverse action has the meaning given to it by section 177 approved information sharing agreement means an information sharing agreement approved by an Order in Council that is for the time being in force code of practice means a code of practice issued under section 35 85 25 30 35 Part 7 cl 138 Privacy Bill department has the meaning given to it by section 6 and also includes— (a) the New Zealand Police: (b) the New Zealand Transport Agency information sharing agreement or agreement means an agreement between or within agencies that enables the sharing of personal information (whether or not the sharing also includes information that is not personal information) to fa- cilitate the provision of a public service lead agency means a department or specified organisation that enters into an information sharing agreement and is designated as the lead agency in— (a) (b) the agreement; and the Order in Council approving the agreement local authority means a local authority or public body named or specified in Schedule 1 of the Local Government Official Information and Meetings Act 1987 Order in Council, except in section 161, means an Order in Council made under section 145(1) organisation means— 5 10 15 (a) (b) an organisation named in Part 2 of Schedule 1 of the Ombudsmen Act 1975; and an organisation named in Schedule 1 of the Official Information Act 1982 20 private sector agency means a non-government agency public sector agency means a department, an organisation, or a local authority public service means a public function or duty that is conferred or imposed on a public sector agency— 25 (a) (b) by or under law; or by a policy of the Government relevant Minister means the Minister who, under the authority of any warrant or with the authority of the Prime Minister, is for the time being responsible for a lead agency sharing, in relation to any information referred to in an approved information sharing agreement,
 means all or any of the following activities if authorised by an approved information sharing agreement: (a) (b) (c) (d) (e) collecting the information: storing the information: checking the information: using the information: disclosing the information: 86 30 35 Privacy Bill Part 7 cl 141 (f) (g) exchanging the information: if necessary, assigning a unique identifier to an individual specified organisation means any of the following organisations: (a) (b) (c) (d) (e) (f) the Accident Compensation Corporation: the Civil Aviation Authority of New Zealand: a district health board: the Earthquake Commission: Education New Zealand: Fire and Emergency New Zealand: (g) Housing New Zealand Corporation: (h) (i) the New Zealand Qualifications Authority: the Tertiary Education Commission: (j) WorkSafe New Zealand.
Compare: 1993 No 28 s 96C 139 Information sharing between agencies An approved information sharing agreement may authorise an agency to share any personal information with 1 or more other agencies in accordance with the terms of the agreement.

Compare: 1993 No 28 s 96D 140 Information sharing within agencies An approved information sharing agreement may authorise a part of an agency to share any personal information with 1 or more parts of the same agency in accordance with the terms of the agreement.
Compare: 1993 No 28 s 96E 141 Parties to information sharing agreement (1) Two or more of the following may enter into an information sharing agree- ment: (a) (b) (c) (d) a public sector agency: a private sector agency: a part of a public sector agency: a part of a private sector agency.

(2) Subsection (1) is subject to subsections (3) and (4).

(3) An overseas agency may not enter into an information sharing agreement.
(4) At least 1 of the agencies that enters into an information sharing agreement must be— 87 Part 7 cl 142 Privacy Bill (a) (b) a public sector agency that is a department or specified organisation; or part of a public sector agency that is a department or specified organisa- tion.
Compare: 1993 No 28 s 96F 142 Agreement may apply to classes of agencies (1) An agency (A) may enter into an information sharing agreement with a depart- ment or specified organisation that specifies a class of agencies to which the agreement may apply.
(2) At any time after an agreement has been entered into, an agency (not being a department or specified organisation) that is a member of a class of agencies specified in the agreement may become a party to the agreement by the lead agency naming that agency as a party in a schedule to the agreement (a Sched- ule of Parties).
(3) If at any time an agency named in the Schedule of Parties no longer wishes to be a party to the agreement, the lead agency must, on the request of that agency, remove the agency’s name from the Schedule of Parties.

(4) A lead agency need not obtain the consent of any other party to the agreement before— 5 10 15 (a) (b) naming an agency in the Schedule of Parties; or removing the name of an agency from the Schedule of Parties.
20 (5) An agency that becomes a party to the agreement under subsection (2) may, but need not, share or participate in the sharing of any personal information with 1 or more other agencies in accordance with the terms of the agreement.

(6) Unless the context otherwise requires, every reference in this Part to a party to an information sharing agreement includes an agency that becomes a party to an agreement under subsection (2) or (3).
Compare: 1993 No 28 s 96G 143 Lead agency (1) (2) If only 1 public sector agency that is a department or specified organisation en- ters into an information sharing agreement, it must be designated as the lead agency for the agreement.

If more than 1 public sector agency that is a department or specified organisa- tion enters into an information sharing agreement, the parties to the agreement may agree between themselves which of those public sector agencies is to be designated as the lead agency.
25 30 35 144 Form and content of information sharing agreement (1) An information sharing agreement must be in writing.
(2) An information sharing agreement must— 88 Privacy Bill Part 7 cl 145 (a) (b) (c) (d) (e) (f) specify with due particularity the purpose of the information sharing agreement: set out the information referred to in section 146: contain an overview of the operational details about the sharing of infor- mation under the agreement: 5 specify the safeguards that will apply to protect the privacy of individu- als and ensure that any interference with their privacy is minimised: if a party to the agreement is a private sector agency, state which public sector agency will be responsible for dealing with complaints about an alleged interference with privacy if the private sector agency is unable to be held to account for those complaints: state that every party to the agreement must give any reasonable assist- ance that is necessary in the circumstances to allow the Commissioner or an individual who wishes to make a complaint about an interference with privacy to determine the agency against which the complaint should be made: 10 15 (g) if entered into under section 142,— (i) designate an agency as the lead agency; and (ii) (iii) specify with due particularity the class of agencies to which the agreement may apply; and 20 include a schedule that sufficiently identifies the agencies within that class that are parties to the agreement.
(3) An information sharing agreement may specify any other terms or conditions that the parties may agree to, including— (a) (b) the fees and charges that are payable under the agreement; and 25 any other business processes relating to the sharing of information under the agreement.

145 Governor-General may approve information sharing agreement by Order in Council (1) The Governor-General may, by Order in Council made on the recommendation of the relevant Minister, approve an information sharing agreement.
30 (2) An Order in Council may grant an exemption from or modify the application of— (a) (b) 1 or more of the IPPs (except IPPs 6 and 7): any code of practice (except a code of practice that modifies IPPs 6 and 7).
35 (3) An Order in Council that, under subsection (2), grants an exemption from 1 or more of the IPPs (except IPPs 6 and 7) or code of practice (except a code of practice that modifies IPPs 6 and 7) may provide that the exemption is un- 89 Part 7 cl 146 Privacy Bill conditional or is subject to any conditions that are prescribed in the Order in Council.
(4) An Order in Council that, under subsection (2), modifies the application of 1 or more of the IPPs or any code of practice may do so by prescribing standards that are more stringent or less stringent than the standards that are prescribed by the principle or, as the case may be, the code of practice.
Compare: 1993 No 28 s 96J 146 Requirements for Order in Council An Order in Council made under section 145(1) must— (a) state, if applicable,— 5 10 (i) (ii) the nature of the exemption granted under section 145(2) and the conditions of the exemption (if any): how any IPPs or codes of practice will be modified under sec- tion 145(2): (b) (c) (d) state the public service or public services the provision of which the in- formation sharing agreement is intended to facilitate: 15 specify with due particularity the personal information or the type of per- sonal information to be shared under the agreement: set out the parties, or classes of parties, to the agreement and designate one of the parties as the lead agency: 20 (e) for every party to the agreement,— (i) (ii) (iii) (iv) describe the personal information or type of personal information that the party may share with each of the other parties; and state how the party may use the personal information; and state the adverse actions that the party can reasonably be expected to take as a result of the sharing of personal information received under the agreement; and specify the procedure that the party must follow before taking ad- verse action against an individual as a result of the sharing of per- sonal information received under the agreement if the requirement in section 152(1) does not apply because of section 153(a)(ii): (f) for every class of agency to which the agreement may apply (if any),— (i) describe the personal information or type of personal information that a member of that class of agency that becomes a party to the agreement (a prospective party) may share with each of the other parties; and (ii) state how a prospective party may use the personal information; and 25 30 35 90 Privacy Bill Part 7 cl 149 (iii) (iv) state the adverse actions that a prospective party can reasonably be expected to take as a result of sharing personal information under the agreement; and specify the procedure that a prospective party must follow before taking adverse action against an individual as a result of sharing personal information under the agreement if the requirement in section 152(1) does not apply because of section 153(a)(ii): (g) state the Internet site address where a copy of the agreement can be ac- cessed.
Compare: 1993 No 28 s 96K 147 Further provisions about Order in Council 5 10 (1) An Order in Council made under section 145(1) must provide that it comes into force on a date specified in the Order in Council (which must not be a date that is before the date on which it is made).
(2) An Order in Council made under section 145(1) must insert into Schedule 15 3— (a) (b) (c) (d) a description of each of the following: (i) (ii) (iii) the information sharing agreement that is approved by the Order in Council: the public service or the public services the provision of which the agreement is intended to facilitate: 20 the personal information or type of personal information that may be shared between or within the agencies that are party to the agreement; and the name of the agreement; and the name of the lead agency for the agreement; and the Internet site address where a copy of the agreement can be accessed.
Compare: 1993 No 28 s 96L 148 Status of Order in Council For the purposes of the Legislation Act 2012, an Order in Council made under section 145(1) is a legislative instrument and a disallowable instrument and must be presented to the House of Representatives under section 41 of that Act.
Compare: 1993 No 28 s 96M 149 Matters to which relevant Minister must have regard before recommending Order in Council (1) Before recommending the making of an Order in Council under section 145(1), the relevant Minister must— (a) be satisfied of the matters set out in subsection (2); and 91 25 30 35 Part 7 cl 150 Privacy Bill (b) have regard to any submissions made under section 150(1)(a) in rela- tion to the information sharing agreement that is proposed for approval by the Order in Council.
(2) The matters referred to in subsection (1)(a) are as follows: (a) that the information sharing agreement will facilitate the provision of a particular public service or particular public services: 5 (b) (c) (d) (e) that the type and quantity of personal information to be shared under the agreement are no more than is necessary to facilitate the provision of that public service or those public services: that the agreement does not unreasonably impinge on the privacy of in- dividuals and contains adequate safeguards to protect their privacy: 10 that the benefits of sharing personal information under the agreement are likely to outweigh the financial and other costs of sharing it: that any potential conflicts or inconsistencies between the sharing of per- sonal information under the agreement and any other enactment have been identified and appropriately addressed.
15 Compare: 1993 No 28 s 96N 150 Consultation on proposed information sharing agreement (1) The parties proposing to enter into an information sharing agreement must, be- fore the proposed agreement is concluded,— 20 (a) consult and invite submissions on the proposed agreement from,— (i) (ii) (iii) the Commissioner; and any person or organisation that the agencies consider represents the interests of the classes of individuals whose personal informa- tion will be shared under the proposed agreement; and 25 any person or organisation that the parties consider represents the interests of any specified class of agency to which the agreement may apply; and (iv) any other person or organisation that the agencies consider should be consulted; and 30 (b) have regard to any submissions made under paragraph (a).
(2) The Commissioner— (a) must consider the privacy implications of the proposed agreement; and (b) may make any submissions under subsection (1)(a)(i) that he or she thinks fit.

35 The agencies must give the relevant Minister a copy of the submissions made under subsection (1)(a) (if any).
Compare: 1993 No 28 s 96O (3) 92 Privacy Bill Part 7 cl 153 151 Commissioner may prepare and publish report on approved information sharing agreement (1) If an information sharing agreement is approved by Order in Council, the Com- missioner may prepare a report for the relevant Minister on any matter relating to privacy that arises or is likely to arise in respect of the agreement.
5 (2) Without limiting subsection (1), the Commissioner may include in a report under that subsection— (a) (b) any comment that he or she wishes to make about the consultation that the agencies carried out under section 150(1)(a); and any submissions that he or she made to the agencies under section 150(1)(a)(i).

(3) The Commissioner— (a) may publish a report under subsection (1); but (b) must consult the relevant Minister before doing so.
Compare: 1993 No 28 s 96P 152 Requirement to give notice of adverse action (1) A party to an approved information sharing agreement must give written notice to an individual before it takes any adverse action against the individual on the basis (whether in whole or in part) of personal information about the individual that was shared under the agreement.
(2) The notice must— 10 15 20 (a) (b) give details of the adverse action that the party proposes to take and the personal information about the individual on which the action is based; and state that the individual has 10 working days from the receipt of the no- tice within which to dispute the correctness of that personal information.
25 (3) To avoid doubt, the individual who is given the notice may take any steps that are available under any enactment to dispute any proposed adverse action against him or her, but the only basis on which he or she may show cause under this section as to why the proposed adverse action should not be taken is that it is based on incorrect personal information.
Compare: 1993 No 28 s 96Q 153 When requirement to give notice of adverse action applies The requirement to give notice under section 152 applies unless— (a) an approved information sharing agreement provides that a party to the agreement may— (i) give a shorter period of notice than the 10-working-day period re- ferred to in section 152(2)(b); or 30 35 93 Part 7 cl 154 Privacy Bill (ii) dispense with the giving of the notice; or (b) if an approved information sharing agreement does not include a provi- sion of the kind specified in paragraph (a), the Commissioner, on the application of a party to an approved information sharing agreement, al- lows the party in the circumstances of a particular case to— (i) (ii) give a shorter period of notice than the 10-working-day period re- ferred to in section 152(2)(b); or dispense with the giving of the notice.
Compare: 1993 No 28 s 96R 154 Responsibilities of lead agency 5 10 (1) A lead agency for an information sharing agreement must, if the agreement is approved by Order in Council under section 145(1),— (a) make a copy of the agreement— (i) (ii) available for inspection, free of charge, at the lead agency’s head office on any working day; and 15 accessible, free of charge, on an Internet site maintained by or on behalf of the lead agency; and (b) (c) prepare a report on the operation of the agreement at the intervals re- quired by the Commissioner under section 156; and carry out any other responsibilities imposed by this Part.
(2) A lead agency does not need to comply with subsection (1)(a)(ii) if the rele- vant Minister designates an Internet site maintained by or on behalf of another public sector agency as the Internet site where a copy of the agreement is to be made accessible free of charge.

(3) To avoid doubt, nothing in this section applies to a party to an information sharing agreement that is not the lead agency except as provided in subsec- tion (2).
Compare: 1993 No 28 s 96S 155 Report of lead agency (1) A report prepared by a lead agency under section 154(1)(b) must include the matters prescribed in regulations made under this Act that the Commissioner specifies after having regard to— 20 25 30 (a) (b) (c) the costs of reporting: the degree of public interest in information about the matters prescribed in those regulations: 35 the significance of the privacy implications of the approved information sharing agreement.
(2) A report must be included— 94 Privacy Bill Part 7 cl 157 (a) in the lead agency’s annual report under the Public Finance Act 1989, if it is required annually; or (b) in the lead agency’s annual report under the Public Finance Act 1989 that immediately follows the end of each interval specified under sec- tion 154(1)(b).
Compare: 1993 No 28 s 96T 156 Commissioner may specify frequency of reporting by lead agency (1) (2) The Commissioner may require a lead agency to prepare a report under sec- tion 154(1)(b)— (a) annually; or (b) at less frequent intervals that the Commissioner may specify.
In determining the appropriate frequency in subsection (1) of a report under section 154(1)(b), the Commissioner must have regard to— (a) the costs of reporting: 5 10 (b) (c) the degree of public interest in information about the matters prescribed in regulations made under this Act: 15 the significance of the privacy implications of the approved information sharing agreement.
Compare: 1993 No 28 s 96U 157 Amendment of approved information sharing agreement (1) This section applies if the parties to an approved information sharing agree- ment amend the agreement (whether in accordance with the Commissioner’s recommendation in a report under section 159(1) or otherwise).
(2) As soon as practicable after the amendment is made, the lead agency must— (a) give written notice of the amendment to— (i) (ii) the Commissioner; and the relevant Minister; and (b) make a copy of the amendment— 20 25 (i) (ii) available for inspection, free of charge, at the lead agency’s head office on any working day; and 30 accessible, free of charge, on the Internet site where a copy of the agreement is accessible.
(3) The information sharing agreement approved by Order in Council continues to have effect as if the amendment notified under subsection (2) had not been made, unless the Governor-General, by a further Order in Council made on the recommendation of the relevant Minister, approves the agreement as amended by the parties.

35 95 Part 7 cl 158 Privacy Bill (4) Sections 145 to 151 apply, subject to any necessary modifications, to the ap- proval of the agreement as amended.
(5) Nothing in subsection (2)(a), (3), or (4) applies if the amendment to an ap- proved information sharing agreement relates only to— (a) (b) (c) (d) (e) the fees and charges payable under the agreement; or 5 a name or description of a party to the agreement; or naming an agency as a party to the agreement under section 142(2); or removing an agency as a party to the agreement under section 142(3); or any terms or conditions of the agreement that the lead agency, after con- sulting the Commissioner, considers do not, or are unlikely to, have any effect on the privacy implications of the agreement.
10 Compare: 1993 No 28 s 96V 158 Review of operation of approved information sharing agreement (1) The Commissioner may, on his or her own initiative, conduct a review of the operation of an approved information sharing agreement— 15 (a) (b) at the end of a period of 12 months after the Order in Council approving the agreement is made; and at any time that the Commissioner considers appropriate for any subse- quent reviews.
20 (2) In conducting a review, the Commissioner must— (a) consult the following persons and organisations about the review: (i) (ii) the parties to the agreement: any person or organisation that the Commissioner considers repre- sents the interests of the classes of individuals whose personal in- formation is being shared under the agreement; and (b) consider any submissions made on the review.

(3) The parties to the agreement must take all reasonable steps to co-operate with the review.
Compare: 1993 No 28 s 96W 159 Report on findings of review (1) After completing a review under section 158, the Commissioner may provide a report to the relevant Minister if he or she has reasonable grounds to suspect that an approved information sharing agreement is— (a) operating in an unusual or unexpected way (that is, in a way that was not foreseen by the Commissioner or the parties to the agreement at the time the agreement was entered into): 25 30 35 96 Privacy Bill Part 7 cl 161 (b) (c) (d) failing to facilitate the provision of the public service or public services to which it relates: unreasonably impinging on the privacy of individuals: operating in such a way that the costs of sharing personal information under the agreement outweigh the benefits of sharing it.
5 (2) The Commissioner may recommend in the report that— (a) (b) the parties to the agreement should amend it in 1 or more material re- spects; or the Order in Council by which the agreement was approved should be revoked.
10 Compare: 1993 No 28 s 96X 160 Relevant Minister must present to House of Representatives copy of report under section 159(1) and report setting out Government’s response The relevant Minister must— (a) (b) present a copy of a report under section 159(1) to the House of Repre- sentatives within 5 working days after receiving it from the Commis- sioner or, if Parliament is not in session, as soon as practicable after the commencement of the next session of Parliament; and as soon as practicable after complying with paragraph (a), present a report to the House of Representatives setting out the Government’s re- sponse to the report under section 159(1).
Compare: 1993 No 28 s 96Y 161 Power to amend Schedule 3 (1) Without limiting the matters that an Order in Council made under section 145 must insert into Schedule 3 in accordance with section 147(2), the Governor-General may, by Order in Council,— (a) make any amendments to Schedule 3 that are required— (i) (ii) (iii) (iv) to recognise the abolition or dissolution of any agency that is party to an approved information sharing agreement or any change in the name of such an agency; or to reflect any change in the Internet site address where a copy of an approved information sharing agreement can be accessed; or to reflect any amendments to an approved information sharing agreement that are approved under section 157; or to correct any error or omission in any description in that sched- ule: (b) repeal any description or matter in Schedule 3, including all of the de- scriptions or matters relating to an approved information sharing agree- 15 20 25 30 35 97 Part 7 cl 162 Privacy Bill ment if the Order in Council by which it was approved has expired or has been revoked: (c) otherwise amend or replace Schedule 3.
(2) To avoid doubt, any of the matters set out in this section may be included in an Order in Council made under section 145 or in a separate Order in Council made under this section.

5 Compare: 1993 No 28 s 96Z Subpart 2—Identity information 162 Purpose of this subpart The purpose of this subpart is to authorise accessing agencies, when carrying out specified functions, to verify the identity of an individual by accessing identity information held about that individual by a holder agency.
163 Relationship between this subpart and other law relating to information disclosure This subpart does not— (a) limit the collection, use, or disclosure of personal information that— (i) (ii) is authorised or required by or under any enactment; or is permitted by the information privacy principles; or (b) limit subpart 1, 3, or 4.
164 Interpretation In this subpart,— 10 15 20 access, in relation to a database, includes remote access to that database accessing agency means an agency specified in the first column of Schedule 4 biometric information, in relation to a person, means information that com- prises— 25 (a) 1 or more of the following kinds of personal information: (i) (ii) a photograph of all or any part of the person’s head and shoulders: impressions of the person’s fingerprints: (iii) a scan of the person’s irises; and 30 (b) an electronic record of the personal information that is capable of being used for biometric matching database means any information recording system or facility used by an agency to store information holder agency means an agency specified in the third column of Schedule 4 35 98 Privacy Bill Part 7 cl 168 identity information, in relation to an individual, means any information that identifies, or relates to the identity of, the individual, and includes (without limitation) the following information: the individual’s biographical details (for example, the individual’s name, address, date of birth, place of birth, and gender): 5 (a) (b) (c) (d) the individual’s biometric information: a photograph or visual image of the individual: details of the individual’s— (i) (ii) New Zealand travel document; or certificate of identity: (e) details of any distinguishing features (including tattoos and birthmarks).
165 Access by agencies to identity information An accessing agency may, for the purpose specified in the second column of Schedule 4 opposite the name of the accessing agency, have access to an indi- vidual’s identity information held by a holder agency specified in the third col- umn of that schedule opposite the name of the accessing agency.
166 Manner and form of access (1) Access to identity information permitted under section 165 may be facilitated between a holder agency and an accessing agency in the manner agreed by the agencies (for example, by direct access to information stored in a holder agen- cy’s database, or by exchange of information between the agencies).
(2) Identity information that is held by a holder agency and accessed by an access- ing agency under section 165 may be made available to the accessing agency in the form agreed by the agencies.
167 Annual reporting requirement The chief executive of an accessing agency must include in every annual report prepared by the chief executive for the purposes of section 43 of the Public Fi- nance Act 1989, or any other applicable enactment requiring an annual report to Parliament, details of the operation of this Part and Schedule 4.
168 Power to amend Schedule 4 by Order in Council (1) The Governor-General may, by Order in Council made on the recommendation of the responsible Minister given after consultation with the Privacy Commis- sioner, amend Schedule 4 by— (a) inserting, repealing, amending, or replacing any item in Schedule 4; or repealing Schedule 4 and substituting a new schedule.
(b) 99 10 15 20 25 30 35 Part 7 cl 169 Privacy Bill (2) Before recommending the making of an Order in Council facilitating access by an accessing agency to identity information held by a holder agency, the re- sponsible Minister must be satisfied that— (a) (b) (c) the purpose for which the identity information is to be accessed relates to a specified function of the accessing agency; and 5 the identity information to be accessed is no more than is reasonably necessary to enable the accessing agency to achieve that purpose; and any potential conflicts or inconsistencies between the sharing of personal information under Schedule 4 and any other enactment have been iden- tified and appropriately addressed.
10 Subpart 3—Law enforcement information 169 Purpose of this subpart The purpose of this subpart is to authorise specified public sector agencies to have access to law enforcement information held by other specified agencies about identifiable individuals.
15 170 Relationship between this subpart and other law relating to information disclosure This subpart does not— (a) limit the collection, use, or disclosure of personal information that— (i) (ii) is authorised or required by or under any enactment; or 20 is permitted by the information privacy principles; or (b) limit subpart 1, 2, or 4.
171 Interpretation In this subpart, unless the context otherwise requires,— accessing agency means any public sector agency for the time being specified in Schedule 5 as an agency to which law enforcement information held by a holder agency is available 25 holder agency means— (a) (b) a court holding law enforcement information described in Schedule 5 as court records; and 30 a public sector agency specified in Schedule 5 holding law enforce- ment information otherwise described in that schedule.
law enforcement information means any information that— (a) (b) is about an identifiable individual; and is specified in Schedule 5.

Compare: 1993 No 28 s 110 35 100 Privacy Bill Part 7 cl 177 172 Access by accessing agencies to law enforcement information (1) An accessing agency may have access to law enforcement information held by (2) a holder agency if such access is authorised by the provisions of Schedule 5.
Subsection (1) prevails over— (a) section 237 and Schedule 1 of the District Court Act 2016; and (b) section 174 and Schedule 2 of the Senior Courts Act 2016.
Compare: 1993 No 28 s 111 173 Power to amend Schedule 5 by Order in Council (1) The Governor-General may, by Order in Council made on the recommendation of the responsible Minister given after consultation with the Privacy Commis- sioner, amend Schedule 5 by— (a) inserting, repealing, amending, or replacing any item in Schedule 5; or repealing Schedule 5 and substituting a new schedule.
(b) (2) However, no Order in Council may be made under subsection (1) that amends law enforcement information in Schedule 5 that is described in that schedule as court records.

Subpart 4—Authorised information matching programmes 5 10 15 174 Purpose of this subpart The purpose of this subpart is to authorise agencies to compare personal infor- mation in accordance with an authorised information matching programme.
20 175 Application of this subpart This subpart applies to the disclosure of personal information under an infor- mation matching programme authorised by an information matching provision that was specified in Schedule 3 of the Privacy Act 1993 before its repeal.
176 Relationship between this subpart and other law relating to information 25 disclosure This subpart does not— (a) limit the collection, use, or disclosure of personal information that— (i) (ii) is authorised or required by or under any enactment; or is permitted by the information privacy principles; or 30 (b) limit subparts 1 to 3.
177 Interpretation In this subpart and Schedule 7, unless the context otherwise requires,— 101 Part 7 cl 177 Privacy Bill adverse action means any lawful action of an agency that may adversely affect the rights, benefits, privileges, obligations, or interests of any specific individu- al, including any decision— (a) (b) (c) (d) (e) (f) (g) (h) (i) to cancel or suspend any monetary payment: to refuse an application for a monetary payment: to alter the rate or amount of a monetary payment: to recover an overpayment of a monetary payment: to impose a penalty: to recover a penalty or fine: to make an assessment of the amount of any tax, levy, or other charge, or of any contribution, that is payable by an individual, or to alter an as- sessment of that kind: to investigate the possible commission of an offence: to make a deportation order in relation to the individual, to serve the in- dividual with a deportation liability notice, or to deport the individual from New Zealand authorised information matching programme means an information match- ing programme that is authorised by an information matching provision discrepancy, in relation to an authorised information matching programme, means a result of that programme that warrants the taking of further action by an agency for the purpose of giving effect to the objective of the programme information matching programme means the comparison (whether manually or by means of any electronic or other device) of any document that contains personal information about 10 or more individuals with 1 or more other docu- ments that contain personal information about 10 or more individuals, for the purpose of producing or verifying information that may be used for the purpose of taking adverse action against an identifiable individual information matching provision means any provision specified in the second column of Schedule 6 as an information matching provision of an enactment specified in the first column of that schedule information matching rules means the rules for the time being set out in Schedule 7 monetary payment includes— (a) (b) (c) a benefit within the meaning of section 3(1) of the Social Security Act 1964: 35 a lump sum payable under section 61DB, 61DC, or 61DD of that Act: any special assistance granted out of a Crown Bank Account from money appropriated by Parliament under section 124(1)(d) or (da) of that Act: 102 Privacy Bill Part 7 cl 180 (d) any monetary entitlement payable under Part 4, 10, or 11 of the Accident Compensation Act 2001.
Compare: 1993 No 28 s 97 178 Information matching agreements (1) Personal information held by an agency may be disclosed to another agency under an authorised information matching programme only in accordance with a written agreement that— 5 (a) (b) is entered into between the agencies; and includes provisions that reflect the information matching rules, or provi- sions that are no less onerous than those rules.
10 (2) An agreement may provide that the agencies involved in the authorised infor- mation matching programme may charge each other fees for the services provi- ded for the purposes of the programme.

(3) The parties to an agreement entered into under this section must ensure that a copy of the agreement, and of any amendments subsequently made to the agreement, are immediately forwarded to the Commissioner.
Compare: 1993 No 28 s 99 179 Use of results of authorised information matching programme (1) (2) (3) Subject to any other enactment or rule of law that limits or restricts the infor- mation that may be taken into account in taking adverse action against an indi- vidual, an agency that is involved in an authorised information matching pro- gramme may take adverse action against an individual on the basis of any dis- crepancy produced by that programme.
If an agency decides to take adverse action against an individual on the basis of a discrepancy produced by an authorised information matching programme, the adverse action must be commenced not later than 12 months after the date on which the agency received or derived information from the programme that gave rise to the discrepancy (or any extended time limit granted by the Com- missioner under section 180).
Subsection (1) does not limit or restrict the use that may lawfully be made, by an agency, of any information produced by an authorised information matching programme.
Compare: 1993 No 28 s 100 180 Extension of time limit If an agency derives or receives information produced by an authorised infor- mation matching programme, the Commissioner may, either generally or in re- spect of any case or class of cases, grant an extension of the time limit set out in section 179(2) in respect of that information if the Commissioner is satis- 15 20 25 30 35 103 Part 7 cl 181 Privacy Bill fied that the agency cannot reasonably be required to meet that time limit be- cause of— (a) (b) (c) the large quantity of information derived or received by the agency; or the complexity of the issues involved; or any other reason.
Compare: 1993 No 28 s 102 181 Notice of adverse action proposed (1) A specified agency must not take adverse action against an individual on the basis (whether in whole or in part) of a discrepancy produced by an authorised information matching programme— (a) unless that agency has given that individual written notice that— (i) (ii) specifies the particulars of the discrepancy and of the adverse ac- tion that it proposes to take; and states that the individual has 5 working days from the receipt of the notice in which to show cause why the action should not be taken; and (b) until the expiration of those 5 working days.
(2) Subsection (1) does not prevent the department for the time being respon- sible for the administration of the Social Security Act 1964 from immediately suspending sole parent support, the supported living payment, an emergency benefit, jobseeker support, a young parent payment, or a youth payment paid to an individual if— (a) (b) the discrepancy arises in respect of departure information supplied to that department under section 280 of the Customs and Excise Act 1996; and before or immediately after the decision to suspend the benefit, the de- partment gives the individual written notice that— (i) (ii) specifies the particulars of the discrepancy and the suspension of benefit, and any other adverse action that the department proposes to take; and states that the individual has 5 working days from the receipt of the notice to show cause why the benefit ought not to have been suspended or why the adverse action should not be taken, or both.
(3) An adverse action must not be taken under subsection (2) until the expiry of the 5 working days referred to in paragraph (b)(ii).
Subsection (1) does not prevent the Commissioner of Inland Revenue from immediately taking action to recover amounts relating to— (4) 104 Privacy Bill Part 7 cl 181 (a) (b) unpaid amounts owed to the Commissioner by an individual who is in serious default and who is identified in information supplied to the Com- missioner under section 280H of the Customs and Excise Act 1996; or financial support under the Child Support Act 1991 owed to the Com- missioner by an individual who is identified in information supplied to the Commissioner under section 280K or 280L of the Customs and Ex- cise Act 1996.
(5) (6) Subsections (1) and (2) do not prevent an agency from taking adverse ac- tion against an individual even if compliance with the requirements of those subsections would prejudice any investigation into the commission of an of- fence or the possible commission of an offence.
Subsection (1) does not prevent any constable or any bailiff from immediate- ly executing a warrant to arrest an individual in respect of the non-payment of all or any part of a fine if— 5 10 (a) the discrepancy arises in respect of arrival and departure information supplied under section 280D of the Customs and Excise Act 1996; and 15 (b) before executing the warrant, the individual concerned is— (i) (ii) (iii) informed of the intention to execute the warrant; and given an opportunity to confirm that he or she is the individual named in the warrant; and 20 given the opportunity to confirm that neither of the following cir- cumstances applies: (A) (B) the fine has been paid: an arrangement to pay the fine over time has been entered into.
25 (7) In this section,— amount of reparation has the same meaning as in section 79(1) of the Sum- mary Proceedings Act 1957 bailiff means a bailiff of the District Court or of the High Court fine means— 30 (a) (b) (c) a fine within the meaning of section 79(1) of the Summary Proceedings Act 1957: a fine to which section 19 of the Crimes Act 1961 applies: a fine to which section 43 or 45 of the Misuse of Drugs Amendment Act 1978 applies: 35 (d) any amount payable under section 138A(1) of the Sentencing Act 2002.
(8) This section is subject to section 180C(1) of the Corrections Act 2004.

Compare: 1993 No 28 s 103(1)–(2), (5) 105 Part 7 cl 182 Privacy Bill 182 Reporting requirements (1) If the Commissioner so requires, an agency that is involved in an authorised information matching programme must report to the Commissioner in respect of that programme.
(2) Without limiting the generality of subsection (1), the matters on which the Commissioner may require an agency to submit a report include the following: 5 (a) (b) (c) (d) (e) the actual costs and benefits of an authorised information matching pro- gramme: any difficulties experienced in the operation of an authorised information matching programme and how those difficulties are being, or have been, overcome: whether internal audits or other forms of assessment are undertaken by an agency in relation to an authorised information matching programme, and, if so, the results of those audits or assessments: if an agency dispenses with the giving of notice under section 181, the reasons why that dispensation is made and the grounds in support of those reasons: the details of the operation of an authorised information matching pro- gramme, including— 10 15 20 (i) (ii) (iii) (iv) (v) (vi) the number of matches undertaken: the proportion of matches that revealed discrepancies in informa- tion involved in the matching: the number of discrepancies revealed: the proportion of cases in which action was taken as a result of the discrepancies: 25 the number of cases in which action was taken: the number of cases in which action was taken even though the accuracy of the discrepancy was challenged: (vii) the proportion of cases in which action did not proceed after the individual concerned was notified of the discrepancy: 30 (viii) the number of cases in which action taken as a result of a discrep- ancy was successful: (f) any other matters that the Commissioner considers relevant.
Compare: 1993 No 28 s 104 183 Reports on authorised information matching programmes 35 The Commissioner must, before the end of each calendar year, report to the Minister on each authorised information matching programme that is carried out (in whole or in part) during the financial year ending on 30 June in that year.
(1) 106 Privacy Bill Part 7 cl 185 (2) A report must set out, in relation to each programme,— (a) (b) (c) an outline of the programme; and an assessment of the extent of the programme’s compliance, during that year, with— (i) (ii) sections 178 to 181; and the information matching rules; and the details of each extension granted under section 180, the reasons why the extension was granted, and the grounds in support of those rea- sons.
(3) (4) This section does not require the Commissioner to disclose in any report any information relating to an information matching programme that would be like- ly to frustrate the objective of the programme.

Sections 90 to 94 apply in relation to an assessment carried out by the Com- missioner for the purposes of subsection (2)(b), and all references in those sections to an investigation must be read as a reference to an assessment.
(5) As soon as practicable after receiving a report, the Minister must present a copy of the report to the House of Representatives.
Compare: 1993 No 28 s 105 184 Reports on information matching provisions (1) The Commissioner must, at 5-yearly intervals,— 5 10 15 20 (a) review the operation of every information matching provision and con- sider, in particular, whether— (i) the authority conferred by the information matching provision should be continued; and (ii) any amendments to the provision are necessary or desirable; and 25 (b) report the result of the review to the responsible Minister.
(2) The first report of an information matching provision under this section is due not later than— (a) (b) 5 years after the date of the last report prepared in respect of that infor- mation matching provision by the Commissioner under section 106 of the Privacy Act 1993; or 5 years after the commencement of this section, if no previous report has been prepared in respect of that information matching provision by the Commissioner.
Compare: 1993 No 28 s 106 30 35 185 Responsible Minister must present to House of Representatives copy of report under section 184 and report setting out Government’s response The responsible Minister must— 107 Part 7 cl 186 Privacy Bill (a) present a copy of a report under section 184 to the House of Represen- tatives within 5 working days after receiving it from the Commissioner or, if Parliament is not in session, as soon as practicable after the com- mencement of the next session of Parliament; and (b) within 6 months after complying with paragraph (a), present a report to the House of Representatives setting out the Government’s response to the report under section 184.
5 186 Avoidance of controls on information matching through use of exceptions to information privacy principles Despite section 176, if the collection or disclosure of information is author- ised by an information matching provision, nothing in IPP 2(2)(e)(i) or IPP 11(e)(i) authorises or permits the collection or disclosure of that information for the purposes of— 10 (a) (b) any authorised information matching programme; or any information matching programme whose objective is similar in nature to any authorised information matching programme.
15 Compare: 1993 No 28 s 108 187 Avoidance of controls on information matching through use of official information statutes Despite anything in the Official Information Act 1982 or the Local Govern- ment Official Information and Meetings Act 1987, no public sector agency may disclose under either of those enactments, to any other public sector agency, any personal information if the sole or principal purpose for which that information is sought is used in an information matching programme.
Compare: 1993 No 28 s 109 188 Power to amend Schedule 6 by Order in Council The Governor-General may, by Order in Council on the recommendation of the responsible Minister,— (a) amend Schedule 6 by— (i) replacing a reference to an information matching provision that has been renumbered with a reference to the corresponding re- numbered information matching provision: (ii) repealing an information matching provision; or (b) repeal Schedule 6.
189 Power to amend Schedule 7 by Order in Council 20 25 30 35 The Governor-General may, by Order in Council made on the recommendation of the Privacy Commissioner, amend the information matching rules in Sched- ule 7.

(1) 108 Privacy Bill Part 8 cl 193 (2) The power conferred by subsection (1) includes the power to— (a) replace Schedule 7: repeal Schedule 7.
(b) Compare: 1993 No 28 s 107 190 Amendments to other enactments related to this subpart 5 The enactments listed in Schedule 8 are amended in the manner set out in that schedule.

191 Expiry of section 190 and Schedule 8 Section 190 and Schedule 8 expire and are repealed on the close of 1 Janu- ary 2020.
10 Part 8 Transfer of personal information outside New Zealand 192 Interpretation In this Part, unless the context otherwise requires,— State includes any State, territory, province, or other part of a country 15 transfer prohibition notice means a notice given under section 193 prohib- iting the transfer of personal information from New Zealand to another State.
Compare: 1993 No 28 s 114A 193 Prohibition on transfer of personal information outside New Zealand (1) The Commissioner may prohibit a transfer of personal information from New 20 Zealand to another State if the Commissioner is satisfied, on reasonable grounds, that— (a) (b) the information has been, or will be, received in New Zealand from an- other State and is likely to be transferred to a third State where it will not be subject to a law providing comparable safeguards to those in this Act; and the transfer would be likely to lead to a contravention of the basic prin- ciples of national application set out in Part Two of the OECD Guide- lines and in Schedule 9 of this Act.
(2) In determining whether to prohibit a transfer of personal information, the Com- missioner must also consider, in addition to the matters set out in subsection (1) and section 18, the following: (a) whether the transfer affects, or is likely to affect, any individual; and 25 30 (b) the general desirability of facilitating the free flow of information be- tween New Zealand and other States; and 35 109 Part 8 cl 194 Privacy Bill (c) any existing or developing international guidelines relevant to transbor- der data flows, including (but not limited to)— (i) (ii) the OECD Guidelines: the European Union Directive 95/46/EC on the protection of indi- viduals with regard to the processing of personal data and on the free movement of such data.
5 (3) Subsection (1) does not apply if the transfer of the information, or the infor- mation itself, is— (a) (b) required or authorised by or under any enactment; or required by any convention or other instrument that imposes internation- al obligations on New Zealand.
10 Compare: 1993 No 28 s 114B 194 Commissioner’s power to obtain information (1) (2) To enable the Commissioner to determine whether to prohibit a transfer of per- sonal information, the Commissioner may hear or obtain information from any person as the Commissioner considers necessary, and for that purpose subpart 2 of Part 5 applies as if the Commissioner were carrying out an investigation under that subpart.
In exercising his or her powers under subsection (1), the Commissioner may regulate his or her procedure in any manner that the Commissioner considers appropriate.

Compare: 1993 No 28 s 114C 195 Transfer prohibition notice (1) A prohibition under section 193(1) is effected by the service of a transfer prohibition notice on the agency that proposes to transfer the personal informa- tion concerned.
(2) A transfer prohibition notice must— 15 20 25 (a) (b) (c) (d) (e) state the name of the agency to whom it relates; and describe the personal information concerned; and state that the transfer of the personal information concerned from New 30 Zealand to a specified State is prohibited— (i) (ii) absolutely; or until the agency has taken the steps stated in the notice to protect the interests of any individual or individuals affected by the trans- fer; and 35 state the time at which the notice takes effect; and state the ground for the prohibition; and 110 (3) (4) (5) Privacy Bill Part 8 cl 196 (f) state that the agency on whom the notice is served may lodge an appeal against the notice to the Human Rights Review Tribunal, and state the time within which the appeal must be lodged.
The time at which the notice takes effect under subsection (2)(d) must not be before the end of the period within which an appeal against the notice can be lodged.

5 If an appeal is brought, the notice does not take effect until the determination or withdrawal of the appeal.
If the Commissioner, by reason of special circumstances, considers that the prohibition should take effect as a matter of urgency in relation to all or any part of the notice,— (a) (b) subsections (3) and (4) do not apply; and the notice takes effect on the sixth working day after the date on which the notice is served; and (c) the notice must include— (i) (ii) a statement that the Commissioner considers that the prohibition must take effect as a matter of urgency; and a statement of the reasons why the Commissioner has reached that conclusion.
Compare: 1993 No 28 114D 196 Commissioner may vary or cancel notice (1) If, at any time, the Commissioner considers that all or any of the provisions of a transfer prohibition notice served on an agency need not be complied with in order to avoid a contravention of basic principles of privacy or data protection, the Commissioner may vary or cancel the transfer prohibition notice by serving notice to that effect on the agency concerned.
(2) An agency on whom a transfer prohibition notice has been served may, at any time after the end of the period during which an appeal under section 198(1)(a) can be lodged, apply in writing to the Commissioner for the notice to be varied or cancelled under subsection (1).
The Commissioner must, within 20 working days after the date on which an application under subsection (2) is received, notify the agency of— (a) his or her decision; and (3) (b) the reasons for the decision, if the application is refused.
(4) If the Commissioner cancels or varies a transfer prohibition notice under sub- section (1), the variation or cancellation of the notice takes effect on the day after the date on which notice of the Commissioner’s decision to vary or cancel the transfer prohibition notice is served.
Compare: 1993 No 28 s 114E 111 10 15 20 25 30 35 Part 8 cl 197 Privacy Bill 197 Offence in relation to transfer prohibition notice Every person who, without reasonable excuse, fails or refuses to comply with a transfer prohibition notice commits an offence and is liable on conviction to a fine not exceeding $10,000.
Compare: 1993 No 28 s 114F 198 Appeals against transfer prohibition notice (1) An agency on whom a transfer prohibition notice is served may appeal to the Human Rights Review Tribunal— (a) (b) (c) (d) against all or any part of the notice; or if the notice contains a statement by the Commissioner in accordance with section 195(5)(c), against the decision to include that statement in respect of all or any part of the notice; or against the decision of the Commissioner to vary the notice in accord- ance with section 196(1); or against the refusal of an application under section 196(2) to vary or cancel the notice.
(2) An appeal under subsection (1) must be lodged,— (a) (b) in the case of an appeal under subsection (1)(a) or (b), within 15 working days from the date on which the transfer prohibition notice was served on the agency concerned: in the case of an appeal under subsection (1)(c) or (d), within 15 working days from the date on which notice of the decision or refusal was served on the agency concerned.
5 10 15 20 (3) The Tribunal must allow an appeal or substitute any other decision or notice that could have been made or served by the Commissioner if it considers that— 25 (a) (b) the decision or notice against which the appeal is brought is not in ac- cordance with the law; or to the extent that the decision or notice involved an exercise of discretion by the Commissioner, the Commissioner ought to have exercised the dis- cretion differently.
30 (4) The Tribunal may review any determination of fact on which the decision or notice in question was based.
(5) On any appeal under subsection (1)(b), the Tribunal may— (a) direct— (i) (ii) that the notice in question must have effect as if it did not contain the statement that is mentioned in the notice; or 35 that the inclusion of the statement must not have effect in relation to any part of the notice; and 112 Privacy Bill Part 9 cl 202 (b) make any modifications required to give effect to that direction.
Compare: 1993 No 28 s 114G 199 Application of Human Rights Act 1993 Section 87 and Part 4 of the Human Rights Act 1993 apply, with any necessary modifications, in relation to proceedings under section 198 as if they were proceedings under that Act.

5 Compare: 1993 No 28 s 114H 200 Power to amend Schedule 9 The Governor-General may, by Order in Council,— (a) amend the principles in Schedule 9 to the extent required to bring them 10 up to date: (b) replace Schedule 9 to update the principles.
Compare: 1993 No 28 s 128A Part 9 Miscellaneous provisions General 15 201 Privacy officers An agency must appoint as privacy officers for the agency 1 or more individu- als whose responsibilities include— (a) (b) (c) (d) the encouragement of compliance, by the agency, with the IPPs: 20 dealing with requests made to the agency under this Act: working with the Commissioner in relation to investigations conducted under Part 5 in relation to the agency: ensuring compliance by the agency with the provisions of this Act.
Compare: 1993 No 28 s 23 202 Commissioner may require agency to supply information For the purpose of enabling the Commissioner to respond to inquiries from the public about personal information held by an agency, the Commissioner may require an agency to supply— (a) (b) the name and contact details of the agency’s privacy officer appointed under section 201; and any other information that the Commissioner reasonably requires in rela- tion to the personal information held by the agency.
Compare: 1993 No 28 s 22 25 30 113 Part 9 cl 203 Privacy Bill 203 Inquiries Sections 91 to 95 apply in relation to an inquiry conducted by the Commis- sioner under section 14(1)(i), and for this purpose all references in those sec- tions to an investigation must be read as a reference to an inquiry.
204 Powers relating to declaratory judgments (1) (2) If, at any time, it appears to the Commissioner that it may be desirable to ob- tain a declaratory judgment or an order of the High Court in accordance with the Declaratory Judgments Act 1908, the Commissioner may refer the matter to the Director of Human Rights Proceedings for the purpose of deciding whether proceedings under that Act should be instituted.
In respect of a matter referred to the Director under subsection (1), the Director, despite anything to the contrary in the Declaratory Judgments Act 1908 or any other enactment or rule of law, has sufficient standing to institute proceedings under that Act whether or not the matter is one within his or her own functions and powers under this Act or under the Human Rights Act 1993.
Compare: 1993 No 28 s 20 205 Protection against certain actions (1) (2) If any personal information is made available in good faith under IPP 6,— (a) no proceedings, civil or criminal, may be brought against the Crown or any other person in respect of the making available of that information, or in respect of any consequences that follow from the making available of that information; and (b) no proceedings, civil or criminal, in respect of any publication involved in, or resulting from, the making available of that information may be brought against the author of the information or any other person by rea- son of that author or other person having supplied the information to an agency.
The making available of, or the giving of access to, any personal information in consequence of a request made under IPP 6 is not to be taken, for the purposes of the law relating to defamation or breach of confidence or infringement of copyright, to constitute an authorisation or approval of the publication of the information or of its contents by the individual to whom the information is made available or the access is given.
Compare: 1993 No 28 s 115 206 Commissioner and staff to maintain secrecy (1) The following persons must maintain secrecy in respect of all matters that come to their knowledge in the exercise of their functions under this Act: (a) the Commissioner, or any person who has held the appointment of Com- missioner: 114 Privacy Bill Part 9 cl 207 (b) a person who is employed or engaged, or who has been employed or en- gaged, by the Commissioner.
(2) Despite subsection (1), the Commissioner may disclose any matters that in the Commissioner’s opinion ought to be disclosed for the purposes of giving effect to this Act.
5 (3) Except where necessary for the purposes of referring a complaint or matter to the Director under section 96(5)(b) or 99(4)(a), the power conferred by subsection (2) does not extend to— (a) any matter that might prejudice— (i) (ii) the security, defence, or international relations of New Zealand (including New Zealand’s relations with the Government of any other country or with any international organisation); or 10 any interest protected by section 7 of the Official Information Act 1982; or (iii) the prevention, investigation, or detection of offences; or 15 (b) (c) any matter that might involve the disclosure of the deliberations of Cab- inet; or any information, answer, document, or thing obtained by the Commis- sioner by reason only of compliance with a requirement made under section 91 or 92.
20 Compare: 1993 No 28 s 116 207 Commissioner may share information with overseas privacy enforcement authority (1) The Commissioner may provide to an overseas privacy enforcement authority any information, or a copy of any document, that the Commissioner— 25 (a) holds in relation to the performance or exercise of his or her functions, duties, or powers under this Act or any other enactment; and (b) considers may— (i) (ii) assist the authority in the performance or exercise of the authori- ty’s functions, duties, or powers under or in relation to any enact- ment; or enable the authority to reciprocate with the provision of other rela- ted information that will assist the Commissioner in the perform- ance or exercise of his or her functions, duties, or powers under this Act or any other enactment.
30 35 (2) The Commissioner may impose any conditions that he or she considers appro- priate in relation to the provision of any information or copy of any document under subsection (1), including conditions related to— (a) the storage and use of, or access to, anything provided: 115 Part 9 cl 208 Privacy Bill (b) the copying, return, or disposal of copies of any documents provided.

(3) This section overrides section 206(1).


208 Consultation (1) The Commissioner may at any time consult any of the following persons about any matter relating to the functions of the Commissioner under this Act: 5 (a) (b) (c) an Ombudsman: the Health and Disability Commissioner: the Inspector-General of Intelligence and Security.

(2) (3) For the purpose of consulting any person, the Commissioner may disclose to that person any information that the Commissioner considers necessary.
10 This section overrides section 206(1).
Compare: 1993 No 28 ss 117, 117A, 117B 209 Exclusion of public interest immunity (1) The rule of law that authorises or requires the withholding of any document, or the refusal to answer any question, on the ground that the disclosure of the document or the answering of the question would be injurious to the public in- terest does not apply in respect of— 15 (a) (b) any investigation by or proceedings before the Commissioner or the Tri- bunal under this Act; or any application under the Judicial Review Procedure Act 2016 for the review of any decision under this Act.
20 Subsection (1) does not entitle any person to any information that he or she would not be entitled to other than under this section.

(2) (3) Subsection (1) does not affect section 49(2)(c).

Compare: 1993 No 28 s 119 210 Adverse comment The Commissioner must not, in any report or statement made pursuant to this Act or the Crown Entities Act 2004, make any comment that is adverse to any person unless that person has been given an opportunity to be heard.
Compare: 1993 No 28 s 120 25 30 Liability and offences 211 Liability of employers and principals (1) For the purpose of this Act,— (a) anything done or omitted to be done by a person (A) as an employee of another person (B) is to be treated as being done or omitted by both A 35 116 Privacy Bill Part 9 cl 212 (b) (c) and B, whether or not it was done or omitted with B’s knowledge or ap- proval: anything done or omitted to be done by a person (A) as an agent of an- other person (B) is to be treated as being done or omitted by both A and B, unless it was done or omitted without B’s express or implied authori- ty: anything done or omitted to be done by a person as a member of an agency is to be treated as being done or omitted by both the person and the agency, unless it is done or omitted without the agency’s express or implied authority.
In proceedings under this Act against any person (C) in respect of an act al- leged to have been done by an employee of that person (D), it is a defence to prove that C took such steps as were reasonably practicable to prevent D from doing that or any similar act.

Subsection (2) overrides subsection (1)(a).
Compare: 1993 No 28 s 126 5 10 15 (2) (3) 212 Offences (1) A person commits an offence against this Act and is liable on conviction to a fine not exceeding $10,000 if the person,— (a) without reasonable excuse, obstructs, hinders, or resists the Commis- sioner or any other person in the exercise of their powers under this Act: 20 (b) without reasonable excuse, refuses or fails to comply with any lawful re- quirement of the Commissioner or any other person under this Act.
(2) A person commits an offence against this Act and is liable on conviction to a fine not exceeding $10,000 if the person— 25 (a) makes any statement or gives any information to the Commissioner or any other person exercising powers under this Act, knowing that the statement or information is false or misleading: (b) represents directly or indirectly that he or she holds any authority under this Act when he or she does not hold that authority: 30 (c) impersonates or falsely pretends to be an individual for the purpose of— (i) (ii) obtaining access to that individual’s personal information: having that individual’s personal information used, altered, or de- stroyed: (d) destroys any document containing personal information, knowing that a request has been made in respect of that information under subpart 1 of Part 4.
Compare: 1993 No 28 s 127 35 117 Part 9 cl 213 Privacy Bill Regulations 213 Regulations (1) The Governor-General may, by Order in Council, make regulations for all or any of the following purposes: 10 15 20 25 (a) (b) (c) (d) providing the procedure for giving notices and documents under this Act: 5 specifying the information to be included in a compliance notice under section 126(1)(e): prescribing the matters that the Commissioner may specify to a lead agency as matters that are to be included in a report by the lead agency under section 155: providing for such matters as are contemplated by or necessary for giv- ing full effect to this Act and for its due administration.
(2) (3) The Governor-General may, by Order in Council made on the recommendation of the responsible Minister given after consultation with the Commissioner, make regulations prescribing countries and States for the purposes of IPP 11(3)(c).

Regulations made under subsection (2) may be subject to any limitations or qualifications specified in those regulations.
Compare: 1993 No 28 s 128 Repeal, revocation, and consequential amendments 214 Repeal and revocation (1) (2) The Privacy Act 1993 (1993 No 28) is repealed.

The Privacy Regulations 1993 (SR 1993/149) are revoked.

215 Consequential amendments The enactments specified in Schedule 10 are consequentially amended in the manner indicated in that schedule.

216 Expiry of section 215 and Schedule 10 Section 215 and Schedule 10 expire and are repealed on the close of 1 January 2020.
30 118 Privacy Bill Schedule 1 Schedule 1 Transitional, savings, and related provisions s 4 Part 1 Provisions relating to this Act as enacted 1 2 Interpretation In this schedule, this Act means the Privacy Act 2018.
Appointment of Privacy Commissioner The person who immediately before 1 July 2019 held office as the Privacy Commissioner under the Privacy Act 1993 continues in office as if the person were appointed under section 10 of this Act, and that person’s instrument of appointment is to be construed accordingly.
3 Appointment of privacy officers Any person who immediately before 1 July 2019 was a privacy officer under section 23 of the Privacy Act 1993 continues as a privacy officer under sec- tion 201 of this Act.

4 Application of IPP 6 and IPP 7 (1) A request made to an agency under information privacy principle 6 of the Pri- vacy Act 1993 before 1 July 2019, but not dealt with by that date, must be treated as a request under IPP 6 and dealt with under this Act.
(2) A request made to an agency under information privacy principle 7 of the Pri- vacy Act 1993 before 1 July 2019, but not dealt with by that date, must be treated as a request under IPP 7 and dealt with under this Act.
5 Authorisations An authorisation given by the Commissioner under section 54 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been made under section 27 of this Act, and is subject to the same conditions (if any) as applied immediately before 1 July 2019.
6 Codes of practice (1) A code of practice issued by the Commissioner under section 46 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been issued under section 35 of this Act.

(2) A code of practice issued by the Commissioner under section 63 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been issued under section 36 of this Act.
119 Schedule 1 Privacy Bill 7 Complaints A complaint made before 1 July 2019 under the Privacy Act 1993 that has not been resolved or otherwise dealt with by the Commissioner must be resolved or otherwise dealt with by the Commissioner under this Act, even though the ac- tion alleged to be, or appearing to be, an interference with the privacy of an individual occurred before 1 July 2019.
5 8 (1) Investigations and inquiries This clause applies to— (a) (b) an investigation that was commenced by the Commissioner under Part 8 of the Privacy Act 1993 before 1 July 2019, but not completed by that date (a pending investigation): 10 an inquiry that was commenced by the Commissioner under section 13(1)(m) or 61(1) of the Privacy Act 1993 before 1 July 2019 but not completed by that date (a pending inquiry).
(2) A pending investigation or pending inquiry must be continued and completed 15 under this Act.

(3) Any decision made, or thing done, by the Commissioner under the Privacy Act 1993 in relation to a pending investigation or pending inquiry must be treated as if it had been made or done under this Act.
9 Proceedings Any proceedings commenced before the Human Rights Review Tribunal under Part 8 of the Privacy Act 1993 before 1 July 2019, but not completed by that date, must be continued and completed under this Act.

10 (1) (2) Notifiable privacy breaches In this clause, notifiable privacy breach has the meaning given to it in sec- tion 117 of this Act.

The provisions of subpart 1 of Part 6 apply to a notifiable privacy breach that occurred before 1 July 2019 if it continues after that date.
11 Information sharing agreements An information sharing agreement made under Part 9A of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force, in accord- ance with its terms, as if it had been made under subpart 1 of Part 7 of this Act.
12 Transfer prohibition notices A transfer prohibition notice given by the Commissioner under section 114B of the Privacy Act 1993 that is in force immediately before 1 July 2019 con- tinues in force, in accordance with its terms, as if it had been given by the Commissioner under section 195 of this Act.
20 25 30 35 120 Privacy Bill Schedule 1 13 (1) Police may continue to access law enforcement information in relation to persons aged 17 years Subclause (2) applies if immediately before 1 July 2019 the Police— (a) either— (i) (ii) are investigating the commission of an offence by a person aged 17; or 5 have commenced proceedings against a person aged 17, but those proceedings have not been completed, or sentencing is pending; and (b) are accessing, or intending to access, the item of law enforcement infor- mation in Schedule 5 of the Privacy Act 1993 relating to Ministry of Justice records described as details of hearings.
(2) If this subclause applies, Schedule 5 of the Privacy Act 1993 continues in force in relation to accessing the records of the person aged 17 years until— (3) 14 (1) (a) (b) (c) (d) the investigation referred to in subclause (1)(a)(i) is completed: the proceedings referred to in subclause (1)(a)(ii) are discontinued or completed: the sentencing referred to in subclause (1)(a)(ii) is completed: the outcome of the proceedings and sentencing referred to in subclause (1)(a)(ii) have been recorded by the Police.
Subclause (2) does not limit the application of section 19 of the Interpretation Act 1999.
Legal Services Commissioner may continue to access law enforcement information in relation to persons aged 17 years Subclause (2) applies if immediately before 1 July 2019 the Legal Services Commissioner is— 25 (a) (b) determining an application for a grant of legal aid made by a person aged 17 years; and accessing, or intending to access, the item of law enforcement informa- tion in Schedule 5 of the Privacy Act 1993 relating to Ministry of Justice records described as details of hearings.
30 10 15 20 (2) If this subclause applies, Schedule 5 of the Privacy Act 1993 continues in force in relation to accessing the records of the person aged 17 years until the Legal Services Commissioner has determined that person’s application.
121 Schedule 2 Privacy Bill Schedule 2 Public registers Enactment Agricultural Compounds and Veterinary Medicines Act 1997 Animal Products Act 1999 Arts Council of New Zealand Toi Aotearoa Act 2014 Auditor Regulation Act 2011 Births, Deaths, Marriages, and Relationships Registration Act 1995 Building Act 2004 Building Societies Act 1965 Chartered Professional Engineers of New Zealand Act 2002 Civil Union Act 2004 Climate Change Response Act 2002 Companies Act 1993 Deeds Registration Act 1908 Designs Act 1953 Dog Control Act 1996 Electoral Act 1993 Electoral Referendum Act 2010 Electricity Act 1992 Financial Markets Conduct Act 2013 Financial Reporting Act 2013 Financial Service Providers (Registration and Dispute Resolution) Act 2008 Fisheries Act 1996 Food Act 2014 Friendly Societies and Credit Unions Act 1982 Gambling Act 2003 Health and Safety in Employment Act 1992 Health Practitioners Competence Assurance Act 2003 Immigration Advisers Licensing Act 2007 Incorporated Societies Act 1908 Industrial and Provident Societies Act 1908 Insolvency Act 2006 Insurance (Prudential Supervision) Act 2010 Land Transfer Act 1952 Land Transfer Regulations 2002 Land Transport Act 1998 Limited Partnerships Act 2008 122 ss 29, 34 Public register provision Section 44ZH Sections 18, 52, 73, and 112S Section 12 Section 38 Sections 5, 7(2), 8, 21B, 24, 25, 34, 36, 48(3), 50, 53, 56, 58, 62A, and 62C Sections 216, 273, and 298 Section 121A Sections 16 to 19 Section 29 Sections 18, 20, 26, 27, and 28 Sections 87, 88, 189, and 360 Sections 21, 22, and 30 Sections 25 and 27 Section 34 Sections 100, 101, 103, 104, 105, 106, 107, 108, 109, 204V, 205R, 206Q, 206ZH, 209E, and 210F Sections 50 and 65 Section 124 Section 215 and clauses 1 and 4 of Schedule 2 Section 36N Section 24 Sections 98 and 124 Clauses 2, 5, 8, 11, and 14 of Schedule 5 Sections 5, 40, and 130 Section 204 Section 19ZZB Section 137 Section 77 Section 33 Section 3D Sections 62, 354, and 368 Section 226 Sections 33 and 50 Regulation 31 Sections 199 and 234 Section 54
 Privacy Bill Schedule 2 Enactment Local Electoral Act 2001 Local Government (Rating) Act 2002 Marriage Act 1955 Motor Vehicle Sales Act 2003 Patents Act 1953 Patents Act 2013 Personal Property Securities Act 1999 Plumbers, Gasfitters, and Drainlayers Act 2006 Private Security Personnel and Private Investigators Act 2010 Radiocommunications Act 1989 Rating Valuations Act 1998 Real Estate Agents Act 2008 Registered Architects Act 2005 Sale of Liquor Act 1989 Secondhand Dealers and Pawnbrokers Act 2004 Social Workers Registration Act 2003 Te Ture Whenua Maori Act 1993 Trade Marks Act 2002 Veterinarians Act 2005 Wine Act 2003 Public register provision Sections 38 Section 27 Section 7 Sections 52 and 73 Sections 83 and 84 Section 194 Sections 139 and 171 to 174 Section 70 Section 97 Sections 5, 6, and 28 Section 7 Sections 63 to 70 Sections 18 to 23 Sections 220 and 221 Section 78 Part 7 Section 263 Section 181 Section 22 Sections 17, 47, and 82S 123 Schedule 124 1 6 1 , ) 2 ( ) s ( e c i v r e s c i l b u P t n e m e e r g a f o e m a N Privacy Bill : r e b m u n e n o h p e l e t e l i b o m : r e b m u n e n o h p e l e t k r o w : s s e r d d a y r e v i l e d t r o p s s a p : s s e r d d a e m o h e n o h p e l e t l a n o s r e p : r e b m u n t r o p s s a p : r e b m u n : ) s ( e m a n t s r i f : h t r i b f o e t a d : e m a n r u s n o i t c a s n a r t l a i c n a n i f : : : n o
n i p i h s n o i t a l e r c i t s e m o d : n o i t a m r o f n i : n o i t a m r o f n i x a t .
s s e r d d a l i a m e : s t e s s a t u o b a n o i t a m r o f n i : n o i t a m r o f n i t n e m y o l p m e : : n o i t a m r o f n i ) a ( ) b ( ) c ( ) d ( ) e ( ) f ( ) g ( ) h ( ) i ( ) j ( ) a ( ) b ( ) c ( ) d ( ) e ( ) f ( ) g ( ) h ( e u n e v e R d n a l n I z n .

t v o g .

d r i .
w w w / / : p t t h g n i d u l c n i ( : ) ( t b e d f o s r e w o r r o b d e s a b - , : : ) t s e r e t n i d n a , s e i t l a n e p , t n e m s s e s s a e r o c ) a ( ) b ( ) c ( , .
) d ( - : s n o i t a g i l b o e u n e v e R d n a l n I z n .
t v o g .

d r i .

w w w / / : p t t h .

 , n o i t c e t e d , n o i t n e v e r p e h t , r a l u c i t r a p n i , .
“ , ) s ( e c i v r e s c i l b u P t n e m e e r g a f o e m a N Privacy Bill Schedule .
: s e t a i c o s s a s ’ ) i ( ) j ( a f o s s e r d d a d n a e m a n e h t ) a ( d n a s e m a n e h t d n a , d l i h c f o , s e s s e r d d a r o s s e r d d a d n a s t n e r a p s ’ d l i h c e h t : s r e v i g e r a c : h t r i b f o e t a d s ’ ’ : ’ d l i h c e h t n i d l i h c a : y l i m a f ) b ( ) c ( ) d ( s ’ d l i h c a t u o b a n o i t a m r o f n i ) e ( : t c e l g e n r o e s u b a s ’ d l i h c a t u o b a n o i t a m r o f n i - , g n i e b ) f ( t n e m p o l e v e D f o y r t s i n i M l a i c o S o g .
n a l p n o i t c a s n e r d l i h c / / : p t t h z n .

t v z n .

t v o g .

d s m w w w .
/ / : p t t h n e r d l i h c e l b a r e n l u v f o g n i e b - , 4 1 0 2 y l u J , , n o i t c e t e d ” 5 1 0 2 125 Schedule 3 Privacy Bill s e u s s i d n a , , g n i e b - l l e w s ’ d l i h c l a i c n a n i f g n i d u l c n i : s e c n a t s m u c r i c : ’ d l i h c a t u o b a n o i t a m r o f n i ) g ( e h t t u o b a n o i t a m r o f n i ) h ( f o s h t g n e r t s d n a s e i t i c a p a c s ’ d l i h c e h t d n a d l i h c a : , n o i t a c u d e s ’ d l i h c a : : : : e c n e l o i v c i t s e m o d f o ) i ( ) j ( ) k ( ) l ( : ) m ( l a n o s r e p f o e p y t r o n o i t a m r o f n i r
) s ( e c i v r e s c i l b u P t n e m e e r g a f o e m a N 126 ) n ( ) s ( e c i v r e s c i l b u P t n e m e e r g a f o e m a N Privacy Bill Schedule .
9 8 9 1 y n a d n a ( e m a n t n e d u t s : ) s e m a n e v i t a n r e t l a : h t r i b f o e t a d : y t i c i n h t e : r e d n e g f i ( n o i t a m r o f n i y c n e d i s e r : ) n w o n k : s s e r d d a e n o h p e l i b o m d n a e m o h : ) n w o n k f i ( s r e b m u n l a c i h p a r g o e g g n i d u l c n i ( : ) : s s e r d d a l i a m e s l o o h c s f o r e b m u n : d e d n e t t a r a e y d n a l o o h c s t f e l e t a d : l e v e l h c a e r o f ( n o s a e r g n i v a e l : ) l o o h c s ) a ( ) b ( ) c ( ) d ( ) e ( ) f ( ) g ( ) h ( ) i ( ) j ( ) k ( ) l ( t n e d u t s t a h t s n o i t n e v r e t n i : : l o o h c s g n i v a e l f o e m i t t a ) m ( y n a f o s l i a t e d ) n ( t n e m p o l e v e D - t e e n / e d i u g - r e d i v o r p - n o i t a m r o f n i / s t n e i l c / s r e d i v o r p - r o f / z n .
t l m t h .

g n i r a h s l a i c o S v o g .

e c i v r e s h t u o y .
, , n o i t a c u d e , n i n i a m e r r o , : / / : 127 Schedule 3 Privacy Bill n i n o i t a p i c i t r a p s ’ t n e d u t s .
) o ( , 6 1 0 2 t c A g n i e b , .
t n e m t c a n e : n o i t a m r o f n i g n i y f i t n e d i , — g n i d u l c n i : n o i t a m r o f n i t c a t n o c ) a ( ) b ( ) c ( , s e m a n s u o i v e r p t c a t n o c , s e s a i l a d n a t n e r r u c e h t s e t a d d n a , ) i ( .

t v o g .
t v o g .

e c i t s u j .
/ / : ) s ( e c i v r e s c i l b u P t n e m e e r g a f o e m a N 128 e u n e v e R d n a l n I / / : p t t h d n a , .
t v o g .

d r i .

w w w / / : p t t h z n .

t v o g .

d s m w w w .
, , , ) s ( e c i v r e s c i l b u P t n e m e e r g a f o e m a N Privacy Bill Schedule 3 r o s a h l a u d i v i d n i d n a ; , , , e m o c n i t u o b a n o i t a m r o f n i , : x a t t u o b a ) i i ( s e c n a n i f t u o b a n o i t a m r o f n i : : : n o s r e p a t s n i a g a .
: t n e m y o l p m e ) d ( ) e ( ) f ( ) g ( ) a ( : 6 1 0 2 , n o i t a m r o f n i d e t t i m r e p ) b ( f o y r t s i n i M e c i t s u J z n .

t v o g .

e c i t s u j .


w w w : m e t s y s / / : : .
) a ( ) b ( ) c ( 129 Schedule 3 Privacy Bill .
, n o i t a m r o f n i d e t t i m r e p ) c ( ) s ( e c i v r e s c i l b u P t n e m e e r g a f o e m a N 130 Privacy Bill Schedule 4 Schedule 4 Identity information Accessing agency Department of Corrections Purpose of access To verify the identity of— (a) (b) a person under control or supervision (as defined in section 3(1) of the Corrections Act 2004): a person who, under section 30B of the Bail Act 2000, has been granted bail with an electronic monitoring condition Department of Internal Affairs To verify the identity of a person who has applied for— (a) the issue of— (i) (ii) (iii) a New Zealand travel document: a certificate of New Zealand citizenship: an electronic identity credential: (b) the registration of a name change ss 165, 168 Holder agency Department of Internal Affairs MBIE (Immigration) Ministry of Health and District Health Boards (only in relation to special patients, restricted patients, and special care recipients) Ministry of Justice New Zealand Police New Zealand Transport Agency Department of Corrections MBIE (Immigration) Ministry of Health and District Health Boards (only in relation to special patients, restricted patients, and special care recipients) New Zealand Police New Zealand Transport Agency MBIE (Immigration) To verify the identity of a person— Department of Corrections (a) (b) (c) (d) who is seeking to travel to New Zealand: who is arriving in or departing from New Zealand: Department of Internal Affairs Ministry of Health and District Health Boards (only in relation to special patients, restricted patients, and special care recipients) who is applying for a visa: Ministry of Justice New Zealand Customs Service
 New Zealand Police New Zealand Transport Agency who an immigration officer has good cause to suspect— (i) (ii) (iii) (iv) has committed an offence against the Immigration Act 2009: has obtained a visa under a fraudulent identity: is liable for deportation or turnaround: is unlawfully in New Zealand 131 Schedule 4 Privacy Bill Accessing agency Ministry of Health and District Health Boards Purpose of access To verify the identity of a person who— (a) (b) is being admitted, or returned, to a hospital as a special patient or restricted patient; or is being admitted, or returned, to a secure facility as a special care recipient Holder agency Department of Corrections Department of Internal Affairs MBIE (Immigration) New Zealand Police New Zealand Customs Service To verify the identity of a person who— (a) (b) is in a Customs controlled area; and is departing, or attempting to depart, from New Zealand Department of Corrections Department of Internal Affairs MBIE (Immigration) Ministry of Health and District Health Boards (only in relation to special patients, restricted patients, and special care recipients) New Zealand Transport Agency New Zealand Police To verify the identity of a person— Department of Corrections Department of Internal Affairs MBIE (Immigration) Ministry of Health and District Health Boards (only in relation to special patients, restricted patients, and special care recipients) New Zealand Customs Service New Zealand Transport Agency (a) (b) (c) whose identifying particulars have been taken under section 32 or 33 of the Policing Act 2008: whose identifying particulars have been taken under section 11 of the Returning Offenders (Management and Information) Act 2015: who has breached, has attempted to breach, or is preparing to breach a condition of any sentence, or order imposed under any enactment, that the person not leave New Zealand Note: A reference in this schedule to MBIE (Immigration) is a reference to the part of the Ministry of Business,
 Innovation, and Employment that administers the Immigration Act 2009.
132 Privacy Bill Schedule 5 Schedule 5 Law enforcement information Court records ss 172, 173 Subject Court document processing Details of hearings Description Particulars of proceedings in respect of which informations are to be laid or charging documents filed; the acceptance of data for and the preparation of associated documents Details of hearings of proceedings in respect of which an information has been laid or charging documents filed, including convictions, sentences, and all other matters ancillary and subsequent to a determination Enforcement of fines and other orders Non-performance of bail conditions Particulars of writs, warrants, or orders in force and issued or made on default in the payment of fines or other monetary sums ordered in proceedings; particulars of the persons to whom the writs, warrants, or orders relate; and particulars of fines, sentences, or orders imposed or made against those persons, including the amounts remaining payable thereunder and the arrangements for payment Records relating to failure to comply with bail conditions Access available to Police Serious Fraud Office Department of Corrections Legal Services Commissioner, limited only to finding out whether an applicant for criminal legal aid has any charges currently pending determination by the courts Police (access is limited so as to exclude details relating to young persons, being persons over 14 years but under 18 years, where the offence did not carry a liability to imprisonment) New Zealand Transport Agency (access is limited to traffic cases only) Serious Fraud Office (access is limited so as to exclude details relating to young persons, being persons over 14 years but under 18 years, where the offence did not carry a liability to imprisonment) Department of Corrections Legal Services Commissioner, for the purpose of determining an application for a grant of legal aid (access is limited so as to exclude details relating to young persons, being persons over 14 years but under 18 years, where the offence did not carry
 a liability to imprisonment) Ministry of Justice (access for the purpose of responding to requests for criminal conviction histories) Police Department of Corrections Legal Services Commissioner, for the purpose of determining an application for a grant of legal aid in relation to a criminal matter Ministry of Justice (access for the purpose of responding to requests for criminal conviction histories) Police 133 Schedule 5 Subject Subject Driver licence stop orders Privacy Bill Description entered under section 39(3) of the Bail Act 2000 Access available to Ministry of Justice records Access available to New Zealand Transport Agency (access is limited to recording, on the driver licence register, the service, cancellation, or termination of an order and any amendments required to the person’s full address and telephone number, and to replacing a driver licence following the cancellation or termination of the order) Description Particulars of each order served, cancelled, or terminated, the full name, full address, telephone number, driver licence number, and date of birth of the person on whom the order was served; the date and time when the order was served on the person, the date of the cancellation or termination of the order, and any amendments required, as at the date of service, cancellation, or termination to the person’s full address and telephone number Police records Subject Details of overseas hearings Description Details of hearings of overseas proceedings before overseas courts, including convictions, sentences, and all other matters ancillary and subsequent to a determination Police temporary file index Offender identity Details of active or recently closed Police files, including the file numbers and location of the files, and the names of complainants, victims, witnesses, suspects, and alleged offenders Particulars of the identity of persons who have been charged with an offence Access available to Ministry of Justice Department of Corrections
 Serious Fraud Office Ministry of Business, Innovation, and Employment (access is limited to obtaining information for the purposes of section 52 of the Outer Space and High-altitude Activities Act 2017) Ministry of Justice (access is limited to— (a) obtaining information about parties to offences for the purpose of processing cases before a court: (b) updating Police records) Department of Corrections (access is limited to identity details for the purposes of— (a) (b) entering information relating to prosecutions initiated otherwise than by the Police; or undertaking criminal history checks of persons wishing to visit prisons who have consented to such a check; or entering information relating to prosecutions initiated otherwise than by the Police; or 134 Privacy Bill Schedule 5 Subject Description Victim identity Medical details The name, sex, date of birth, address, and telephone number of persons who are the victims of a criminal offence in respect of which another person has been charged An indicator to identify persons who are or have been special patients under the Mental Health (Compulsory Assessment and Treatment) Act 1992 or any former Act and the hospitals at which those persons are or have been detained as special patients, or as committed patients, or as patients (within the meaning of that Act) Access available to (c) research conducted by the department, and with the limitation that information so obtained must not be published in a form which could reasonably be expected to identify the individual concerned) Ministry of Justice (access is limited to— (a) identity details for the purposes of— (i) (ii) entering information relating to prosecutions initiated otherwise than by the Police; or providing assistance to victims in accordance with the Sentencing Act 2002, the Parole Act 2002, the Victims’ Rights Act 2002, and the Prisoners’ and Victims’ Claims Act 2005; or (b) (iii) updating an existing database of court proceedings; or obtaining information
 for the purpose of research conducted by the Ministry, and with the limitation that information so obtained must not be published in a form that could reasonably be expected to identify the individual concerned) Ministry of Business, Innovation, and Employment (access is limited to obtaining information for the purposes of section 52 of the Outer Space and High-altitude Activities Act 2017) Ministry of Justice (access is limited to identity details for the purpose of providing assistance to victims in accordance with the Sentencing Act 2002, the Parole Act 2002, the Victims’ Rights Act 2002, and the Prisoners’ and Victims’ Claims Act 2005) New Zealand Transport Agency (access is limited to obtaining information for the purposes of— (a) (b) subpart 2 of Part 4A of the Land Transport Act 1998; or section 19 of the Land Transport Act 1998 Department of Corrections Ministry of Justice 135 Schedule 5 Privacy Bill Subject Traffic offence and infringement enforcement and document processing Description Traffic offence and infringement enforcement processing, including infringement fees enforcement and preparation of documents Particulars of motor vehicles stolen, unlawfully taken, missing, abandoned, or found, or where location is for other reasons required to be known by the Police Particulars of an impounded vehicle, including make, model, type, registration plate number, vehicle identification number; the section of the Land Transport Act 1998 under which it is impounded, the date on which it was impounded, and the place where it is impounded; whether any appeals are yet to be determined; particulars of the person who was driving the vehicle immediately before its impoundment, including the full name, full address, telephone number, occupation, driver licence number, and date of birth of that person and the same particulars also for every person, other than that driver, who is registered in respect of the vehicle Particulars concerning persons wanted for arrest Vehicles
 of interest Vehicles impounded under Land Transport Act 1998 Wanted persons 136 Access available to New Zealand Transport Agency Ministry of Justice (access is limited to obtaining information for the purpose of processing cases before a court) Legal Services Commissioner (access is limited to obtaining information for the purpose of processing cases before a court, and for determining an application for a grant of legal aid relating to a criminal matter) Registrar of Motor Vehicles (access is limited so as to exclude such particulars as the Police may determine in any case) Ministry of Justice (access is limited to giving effect to action taken, under Part 3 of the Summary Proceedings Act 1957, to enforce the payment of fines, reparation, and related payments) New Zealand Transport Agency (access is limited to obtaining information for the purposes of— (a) (b) subpart 2 of Part 4A of the Land Transport Act 1998: carrying out the functions conferred on the Agency by section 95(1) of the Land Transport Management Act 2003 Ministry of Justice (access is limited to persons wanted in connection with fines enforcement) Ministry of Business, Innovation, and Employment (access is limited to obtaining Privacy Bill Schedule 5 Subject Description Missing persons Particulars concerning persons missing or required to be located Firearms licences Protection orders Particulars of persons authorised to possess firearms in accordance with the Arms Act 1983 Details of protection orders made under the Domestic Violence Act 1995 Restraining orders Details of restraining orders made under the Harassment Act 1997 Access available to information for the purposes of section 52 of the Outer Space and High-altitude Activities Act 2017) New Zealand Transport Agency (access is limited so as to exclude such particulars as the Police may determine in any case) Ministry of Justice (access is limited to persons required to be located in connection with fines enforcement) Ministry of Justice
 (access is limited to identity details of persons who possess firearms, where that information is required for the purpose of serving orders made under the Domestic Violence Act 1995) Department of Corrections (access is limited to obtaining information about any offender who is subject to a protection order while also subject to— (a) (b) (c) (d) (e) (f) a full-time custodial sentence (including while released on parole or subject to conditions imposed under section 93 of the Sentencing Act 2002); or a sentence of supervision, intensive supervision, community work, or community detention; or a non-association order; or a sentence of home detention (including while subject to post- detention conditions); or an extended supervision order; or a public protection order, a prison detention order, or a protective supervision order under the Public Safety (Public Protection Orders) Act 2014.
Access is for the purpose of managing the offender’s sentence, any post-sentence conditions, any post-sentence supervision, or any order under the Public Safety (Public Protection Orders) Act 2014 in a manner consistent with any protection order.)
Department of Corrections (access is limited to obtaining information about any offender who is subject to a restraining order while also subject to— (a) a full-time custodial sentence (including while released on parole or subject to conditions imposed under section 93 of the Sentencing Act 2002); or 137 Schedule 5 Privacy Bill Subject Description Non-contact orders Details of non-contact orders made under the Victims’ Orders Against Violent Offenders Act 2014 Access available to (b) a sentence of supervision, intensive supervision, community work, or community detention; or (c) (d) (e) (f) a non-association order; or a sentence of home detention (including while subject to post- detention conditions); or an extended supervision order; or a public protection order, a prison detention order, or a protective supervision order under the Public Safety (Public Protection) Orders Act 2014.
Access is for the purpose of managing the offender’s sentence, any post-sentence conditions, any post-sentence supervision, or any order under the Public Safety (Public Protection Orders) Act 2014 in a manner consistent with any restraining order.)
Department of Corrections (access is limited to obtaining information about any offender who is subject to a non-contact order while also subject to— (a) (b) (c) (d) (e) (f) a full-time custodial sentence (including while released on parole or subject to an extended supervision order made under section 1071 of the Parole Act 2002 or to conditions imposed under section 93 of the Sentencing Act 2002); or a sentence of intensive supervision, community detention, community work, or supervision; or a non-association order; or a sentence of home detention (including while subject to post- detention conditions); or an extended supervision order; or a public protection order, a prison detention order, or a protective supervision order under the Public Safety (Public Protection) Orders Act 2014.
Access is for the purpose of managing the offender’s sentence, any post-sentence conditions, any post-sentence supervision, or any order under the Public Safety (Public Protection Orders) Act 2014 in a manner consistent with any non-contact order.)
138 Privacy Bill Schedule 5 New Zealand Transport Agency records Access available to Description Department of Corrections A national register of all driver licences Ministry of Justice Subject Driver licence register (except photographic images on driver licences) Police Serious Fraud Office Road User Charges Collector (access is limited to obtaining information for the purpose of verifying the identity of people who are or apply to be holders of licences issued under the Road User Charges Act 2012) Registrar of Motor Vehicles (access is limited to obtaining information for the purposes of— verifying the identity of people who are or apply to be registered in respect of motor vehicles on the register of motor vehicles; or correcting or updating information held on the register of motor vehicles about such people) (a) (b) Police Police Police Transport services licensing register Demerit points Rail licensing register A national register of all transport service licences The recording of demerit points in relation to traffic offences A national register of all licences under the Railways Act 2005 Registrar of Motor Vehicles records Subject Motor vehicles register Description A national register of all motor vehicles Access available to Ministry of Justice (including for the purpose of enforcing civil debts) Police Serious Fraud Office WorkSafe New Zealand (access is limited to name and address details of persons who are or were previously registered in respect of a specified vehicle for the purposes of enforcing the health and safety at work legislation) Ministry of Business, Innovation, and Employment (access is limited to name and address details of persons who are or were previously registered in respect of a specified vehicle for the purposes of enforcing immigration legislation) Ministry for Primary Industries (access is limited to name and address details of 139 Schedule 5 Privacy Bill Subject Description Access available to persons who are or were previously registered in respect of a specified vehicle for the purposes of enforcing fisheries legislation and any other enactment that confers enforcement powers on fisheries officers) New Zealand Customs Service (access is limited to obtaining information for the purposes of enforcing legislation for which the Service has enforcement powers) New Zealand Transport Agency (access is limited to obtaining information for the purposes of carrying out the functions conferred on the Agency by section 95(1) of the Land Transport Management Act 2003) Legal Services Commissioner (access is limited to obtaining information for the purpose of determining financial eligibility of an applicant for a grant of legal aid in relation to a criminal matter) An enforcement authority under the Land Transport Management Act 2003.
Road User Charges Collector records Subject Road user charges Description Details of licences issued under the Road User Charges Act 2012 and details of the corresponding licence holders Access available to Police (access is limited to obtaining information for the purpose of enforcing the Road User Charges Act 2012) New Zealand Transport Agency (access is limited to obtaining information for the purposes of carrying out the functions conferred on the Agency by section 95(1) of the Land Transport Management Act 2003) Department of Corrections records Description Particulars of persons— Access available to Police (access is limited to— (a) (b) the person’s area of reporting: in the case of a person released from a prison, the conditions of the person’s release (whether imposed on release or imposed or varied subsequently, and including any direction issued to that person by a probation officer)) Ministry of Justice (a) (b) released on probation or parole, or released on conditions under Part 6 of the Criminal Justice Act 1985, or sentenced to supervision; or released on parole, home detention, or compassionate release under subpart 2 of Part 1 of the Parole Act 2002 or sentenced to supervision, intensive Subject Community-based sentences, sentences of home detention, and conditions of release 140 Privacy Bill Schedule 5 Subject Description Access available to supervision, community work, community detention, or home detention.
Extended supervision orders Records of prisoners Details of extended supervision orders made under Part 1A of the Parole Act 2002 Particulars of prisoners in a prison, including the date of release from the prison Police (access is for the purpose of managing the conditions of the extended supervision order) Police (access is limited to the location and the date of release of the prisoner) Ministry of Justice 141 Schedule 6 Privacy Bill Schedule 6 Information matching provisions Enactment Accident Compensation Act 2001 Births, Deaths, Marriages, and Relationships Registration Act 1995 Citizenship Act 1977 Corrections Act 2004 Customs and Excise Act 1996 Education Act 1989 Electoral Act 1993 Electronic Identity Verification Act 2012 Immigration Act 2009 Motor Vehicle Sales Act 2003 Social Security Act 1964 Social Welfare (Reciprocity Agreements, and New Zealand Artificial Limb Service) Act 1990 Student Loan Scheme Act 2011 Tax Administration Act 1994 ss 177, 188 Information matching provision Sections 246, 280, and 281 Section 78A Section 26A Sections 180 to 180D and 181 Sections 280 to 280D, 280H, and 280K Sections 226A, 235F, 307D, and 360 Sections 263A and 263B Section 39 Sections 294, 295, 298, 299, and 300 Sections 120 to 123 Sections 126A and 126AC Section 19D(3)(b) Section 208 Sections 82, 85A, 85B, and 85E 142 Privacy Bill Schedule 7 Schedule 7 Information matching rules ss 177, 178, 189 1 Notice to individuals affected (1) Agencies involved in an authorised information matching programme must take all reasonable steps (which may consist of or include public notification) to ensure that the individuals who will be affected by the programme are noti- fied of the programme.
(2) Nothing in subclause (1) requires an agency to notify any individual about an authorised information matching programme if to do so would be likely to frus- trate the objective of the programme.

2 Use of unique identifiers Except as provided in any other enactment, unique identifiers may not be used as part of any authorised information matching programme unless their use is essential to the success of the programme.
3 (1) (2) Technical standards The agency primarily responsible for the operation of an authorised informa- tion matching programme must establish and maintain detailed technical stand- ards to govern the operation of the programme.
The technical standards established by an agency in accordance with sub- clause (1) must deal with the following matters: (a) the integrity of the information to be matched, with particular reference to— (i) (ii) key terms and their definition; and relevance, timeliness, and completeness: (b) the matching techniques to be used in the programme, with particular reference to— (i) (ii) (iii) (iv) (v) the matching algorithm: any use of unique identifiers: the nature of the matters being sought to be identified by the matching process: 30 the relevant information definitions: the procedure for recognising matches: (c) the controls being used to ensure the continued integrity of the pro- gramme, including the procedures that have been established to confirm 35 the validity of matching results: 143 Schedule 7 Privacy Bill (d) the security features included within the programme to minimise and audit access to personal information, including the means by which the information is to be transferred between agencies.
(3) The technical standards established in accordance with subclause (1) must be incorporated in a written document (in this clause, a Technical Standards Re- port), and copies of the Technical Standards Report must be held by all agen- cies that are involved in the authorised information matching programme.

(4) Variations may be made to a Technical Standards Report by way of a Variation Report appended to the original report.
(5) (6) (7) 4 (1) (2) The agency that prepares a Technical Standards Report must forward a copy of that report, and of every Variation Report appended to that report, to the Com- missioner.

The Commissioner may at any time direct that a Technical Standards Report be varied, and that direction must be complied with by the agency that prepared the report.
Every agency involved in an authorised information matching programme must comply with the requirements of the associated Technical Standards Report (in- cluding any variations made to the report).

Safeguards for individuals affected by results of programmes The agencies involved in an authorised information matching programme must establish reasonable procedures for confirming the validity of discrepancies be- fore an agency seeks to rely on them as a basis for action in respect of an indi- vidual.
Subclause (1) does not apply if the agencies concerned consider that there are reasonable grounds to believe that the results are not likely to be in error, and in forming that view the agencies must have regard to the consistency in content and context of the information being matched.
(3) Where those confirmation procedures do not take the form of checking the re- sults against the source information, but instead involve direct communication with the individual affected, the agency that seeks to rely on the discrepancy as a basis for action in respect of an individual must notify the individual affected that no check has been made against the information which formed the basis for the information supplied for the programme.
Every notification in accordance with subclause (3) must include an explan- ation of the procedures that are involved in the examination of a discrepancy revealed by the programme.
Destruction of information In this clause, information matching information means— (a) information disclosed to an agency under an information matching pro- vision for use in an authorised information matching programme; and 40 (4) 5 (1) 144 Privacy Bill Schedule 7 (b) information that is produced from an authorised information matching programme.
(2) Information matching information held by an agency that does not reveal a dis- crepancy must be destroyed as soon as practicable by the agency.

(3) An agency that holds information matching information that reveals a discrep- ancy must destroy that information within 60 working days after becoming aware of the discrepancy unless the agency decides to take adverse action against any individual on the basis of that discrepancy.
(4) An agency that decides to take adverse action against any individual on the basis of a discrepancy must destroy the information as soon as practicable after the information is no longer required.

(5) 6 (1) (2) (3) This clause does not apply in relation to the Inland Revenue Department.
No new databank Subject to subclauses (2) and (3), the agencies involved in an authorised in- formation matching programme must not permit the information used in the programme to be linked or merged in such a way that a new separate perman- ent register or databank of information is created about all or any of the indi- viduals whose information has been subject to the programme.
Subclause (1) does not prevent an agency from maintaining a register of indi- viduals in respect of whom further inquiries are warranted following a discrep- ancy revealed by the programme, but information relating to an individual may be maintained on a register of that kind only for so long as is necessary to enable those inquiries to be carried out, and in no case longer than is necessary to enable any adverse action to be taken against an individual.
Subclause (1) does not prevent an agency from maintaining a register for the purpose of excluding individuals from being selected for investigation, but that register may only contain the minimum amount of information necessary for that purpose.
145 Schedule 8 Privacy Bill Schedule 8 Amendments to other enactments related to subpart 4 of Part 7 Accident Compensation Act 2001 (2001 No 49) After section 246(7), insert: s 190 5 (8) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
(9) On or after 1 July 2019, no new agreement may be entered into under this 10 section and subpart 4 of Part 7 of the Privacy Act 2018.

After section 280(5), insert: (6) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
(7) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.

After section 281(5), insert: (6) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
(7) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.
Births, Deaths, Marriage, and Relationships Registration Act 1995 (1995 No 16) After section 78A(4A), insert: (4B) Any agreement entered into under subsection (2) and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under subsection (2) and subpart 4 of Part 7 of the Privacy Act 2018 and may at any time be amended.
(4C) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.

Replace section 78B(3) with: 15 20 25 30 (3) A request must be made in accordance with an agreement entered into between 35 the department and the Registrar-General.
146 Privacy Bill Schedule 8 Citizenship Act 1997 (1997 (No 61) After section 26A(5A), insert: (5B) Any agreement entered into under subsection (2) and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under subsection (2) and subpart 4 of Part 7 of the Privacy Act 2018 and may at any time be amended.
(5C) On or after 1 July 2019, no new agreement may be entered into under this subsection (2) and subpart 4 of Part 7 of the Privacy Act 2018.
In section 26A(6), replace the definition of specified agency with: specified agency means any of the following agencies: 5 10 (a) (b) (c) (d) (e) (f) (g) (h) (i) (j) (k) (l) the Accident Compensation Corporation: the Regulator, as defined by Part 10 of the Accident Compensation Act 2001: the Electoral Commission established by section 4B of the Electoral Act 1993: 15 the company within the meaning of section 2(1) of the Housing Restruc- turing and Tenancy Matters Act 1992: the board of the Government Superannuation Fund Authority: the Board of Trustees of the National Provident Fund: the Ministry of Health: the Ministry of Justice: the Department of Corrections: 20 the Ministry of Business, Innovation, and Employment: the department for the time being responsible for the administration of the Social Security Act 1964: 25 the Housing New Zealand Corporation established (as the Housing Cor- poration of New Zealand) by section 3(1) of the Housing Corporation Act 1974: (m) the Inland Revenue Department: (n) (o) (p) (q) (r) (s) (t) the Ministry of Transport: the New Zealand Transport Agency: the Department of Internal Affairs: the Registrar-General appointed under section 79(1) of the Births, Deaths, Marriages, and Relationships Registration Act 1995: the New Zealand Customs Service: the Registrar of Motor Vehicle Traders: the Regulator, as defined in the Accident Insurance Act 1998: 30 35 147 Schedule 8 Privacy Bill Citizenship Act 1997 (1997 (No 61)—continued (u) WorkSafe New Zealand: (v) (w) (x) (y) any tertiary institution, secondary school, or private training establish- ment (as those terms are defined in the Education Act 1989) to which section 226A or section 238B of that Act applies, as from time to time notified to the Commissioner by the department for the time being re- sponsible for the administration of the Social Security Act 1964: 5 the Ministry of Education: the Education Council of Aotearoa New Zealand established under Part 32 of the Education Act 1989: the agency or agencies appointed under section 100 of the Housing Re- structuring and Tenancy Matters Act 1992.
10 Corrections Act 2004 (2004 No 50) After section 180A(3), insert (4) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 to record arrangements made under this section that is in force immedi- ately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018 and may at any time be amended.
(5) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018 to record ar- rangements made under this section.

In section 180C(2), definition of adverse action, replace “section 97 of the Privacy Act 1993” with “section 177 of the Privacy Act 2018”.

In section 180C(2), definition of discrepancy, replace “section 97 of the Privacy Act 1993” with “section 177 of the Privacy Act 2018”.
In section 180C(2), definition of working day, replace “section 2(1) of the Privacy Act 1993” with “section 6 of the Privacy Act 2018”.

After section 180C(2), insert: (2A) Subsections (3) to (5) apply in respect of an agreement entered into under section 180A that, because of section 180A(4), continues in force as if it had been entered into under that section and subpart 4 of Part 7 of the Privacy Act 2018.
After section 181(5), insert: (5A) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
15 20 25 30 35 148 Privacy Bill Schedule 8 Corrections Act 2004 (2004 No 50)—continued (5B) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.
Customs and Excise Act 1996 (1996 No 27) After section 280(7), insert: (8) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.

(9) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.
After section 280B(6), insert: (7) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 to record arrangements for the supply of information under subsection (2) that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018 and may at any time be amended.
(8) On and after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018 to record ar- rangements for the supply of information under subsection (2).
After section 280D(5), insert: 5 10 15 20 (6) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.

(7) On or after 1 July 2019, no new agreement may be entered into under this 25 section and subpart 4 of Part 7 of the Privacy Act 2018.
After section 280H(5), insert: (6) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.

(7) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.
After section 280K(5), insert: (6) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
30 35 149 Schedule 8 Privacy Bill Customs and Excise Act 1996 (1996 No 27)—continued (7) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.
Education Act 1989 (1989 No 80) In section 226A(3), delete “in accordance with arrangements under the Privacy Act 1993 previously agreed between the chief executive and any institution (or, where they are unable to agree, in accordance with arrangements under that Act settled by the Privacy Commissioner appointed under the Privacy Act 1993),”.

In section 226A(8), replace “the Privacy Act 1993” with “the Privacy Act 2018” in each place.
After section 226A(8), insert: (8A) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 to record arrangements for the supply of information under subsection (7) that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018 and may at any time be amended.
Replace section 226A(9) with: (9) In respect of any agreement to which subsection (8A) refers, section 182 of the Privacy Act 2018 applies as if subsection (1) of that section also requires the Commissioner, before seeking a report of any of the matters in section 182(2)(a), (d), or (e) from a tertiary institution, to seek a report on the matter from the department for the time being responsible for the adminis- tration of the Social Security Act 1964.
After section 226A(9), insert: (10) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018 to record ar- rangements for the supply of information under this section.
In section 235F(3), delete “in accordance with arrangements under the Privacy Act 1993 previously agreed between the chief executive and any institution (or, where they are unable to agree, in accordance with arrangements under that Act settled by the Privacy Commissioner appointed under the Privacy Act 1993),”.

In section 235F(8), replace “the Privacy Act 1993” with “the Privacy Act 2018”.
After section 235F(8), insert: (8A) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 to record arrangements for the supply of information under subsection (7) that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018 and may at any time be amended.
Replace section 235F(9) with: 150 Privacy Bill Schedule 8 Education Act 1989 (1989 No 80)—continued (9) In respect of any agreement to which subsection 8A refers, section 182 of the Privacy Act 2019 applies as if subsection (1) of that section also re- quires the Commissioner, before seeking a report of any of the matters in sec- tion 182(2)(a), (d), or (e) from a tertiary institution, to seek a report on the matter from the department for the time being responsible for the administra- tion of the Social Security Act 1964.
After section 235F(9), insert: (10) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018 to record ar- rangements for the supply of information under this section.
After section 307D(2), insert: (3) Any agreement for the supply of information entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018 and may at any time be amended.

(4) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.
In section 360(2), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 360(3), replace “Privacy Act 1993” with “Privacy Act 2018”.

After section 360(3), insert: (3A) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 to record arrangements made under this section that is in force immedi- ately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018 and may at any time be amended.
(3B) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018 to record ar- rangements made under this section.
Electoral Act 1993 (1993 No 87) After section 263A(6), insert: (7) Any agreement for the supply of information entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018 and may at any time be amended.

(8) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.
151 Schedule 8 Privacy Bill Electoral Act 1993 (1993 No 87)—continued After section 263B(5), insert: (5A) Any agreement for the supply of information entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018 and may at any time be amended.
(5B) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.

Electronic Identity Verification Act 2012 (2012 No 123) After section 39(4), insert: 5 10 (5) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
(6) On or after 1 July 2019, no new agreement may be entered into under this 15 section and subpart 4 of Part 7 of the Privacy Act 2018.

Immigration Act 2009 (2009 No 51) After section 294(4), insert: (4A) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
(4B) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.

After section 295(3), insert: 20 25 (3A) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
(3B) On or after 1 July 2019, no new agreement may be entered into under this 30 section and subpart 4 of Part 7 of the Privacy Act 2018.

After section 298(6), insert: (6A) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
35 (6B) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.
152 Privacy Bill Schedule 8 Immigration Act 2009 (2009 No 51)—continued After section 299(5), insert: (5A) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
(5B) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.

After section 300(8), insert: (8A) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
(8B) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.
Motor Vehicle Sales Act 2003 (2003 No 12) After section 121(2), insert: (3) Any agreement for the supply of information entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018 and may at any time be amended.
(4) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.

After section 123(2), insert: (3) Any agreement for the supply of information entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018 and may at any time be amended.
(4) On or after 1 July 2019, no new agreement may be entered into under this 30 section and subpart 4 of Part 7 of the Privacy Act 2018.

Social Security Act (1964 No 136) After section 126A(5), insert: (6) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
35 153 Schedule 8 Privacy Bill Social Security Act (1964 No 136)—continued (7) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.

Replace section 126AB(3) with: (3) A request must be made in accordance with an agreement entered into between the department and the Registrar-General (not being an agreement entered into under subpart 4 of Part 7 of the Privacy Act 2018).
5 After section 126AC(6), insert: (7) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.

(8) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.
Social Welfare (Reciprocity Agreements, and New Zealand Artificial Limb Service) Act 1990 (1990 No 26) Replace section 19C(1)(d) (iii) to (v) with: (iii) in relation to New Zealand, requires the information matching rules set out in clause 3 of Schedule 7 of the Privacy Act 2018, with all necessary modifications, to be applied: Replace section 19C(2) with: (2) In relation to New Zealand, section 178(3) of the Privacy Act 2018 ap- plies, with any necessary modifications, to any amendments made to an agree- ment between the competent institutions of the parties under subsection (1)(d).
(3) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may be at any time be amended.

(4) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.
Student Loan Scheme Act 2011 (2011 No 62) After section 208(4), insert: (5) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.

(6) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.
10 15 20 25 30 35 154 Privacy Bill Schedule 8 Tax Administration Act 1994 (1994 No 166) After section 82(8), insert: (8A) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
(8B) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.

After section 85A(4A), insert: (4B) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
(4C) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.

After section 85B(6), insert: (6A) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
(6B) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.

After section 85E(2), insert: (2A) Any agreement entered into under this section and Part 10 of the Privacy Act 1993 that is in force immediately before 1 July 2019 continues in force as if it had been entered into under this section and subpart 4 of Part 7 of the Pri- vacy Act 2018 and may at any time be amended.
(2B) On or after 1 July 2019, no new agreement may be entered into under this section and subpart 4 of Part 7 of the Privacy Act 2018.

5 10 15 20 25 155 Schedule 9 Privacy Bill Schedule 9 Basic principles of national application set out in Part Two of the OECD Guidelines ss 193, 200 Collection limitation principle There should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.
Data quality principle Personal data should be relevant to the purposes for which they are to be used, and, to the extent necessary for those purposes, should be accurate, complete and kept up-to- date.
Purpose specification principle The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfilment of those purposes or such others as are not incompatible with those purposes and as are speci- fied on each occasion of change of purpose.
Use limitation principle Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with [the Purpose specification principle above] except: 5 10 15 20 (a) (b) with the consent of the data subject; or by the authority of law.

Security safeguards principle Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorised access, destruction, use, modification or disclosure of data.
25 Openness principle There should be a general policy of openness about developments, practices and policies with respect to personal data.

Means should be readily available of establish- ing the existence and nature of personal data, and the main purposes of their use, as well as the identity and usual residence of the data controller.
30 Individual participation principle An individual should have the right: (a) to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to them; 35 156 Privacy Bill Schedule 9 (b) to have communicated to them, data relating to them • • • • within a reasonable time; at a charge, if any, that is not excessive; in a reasonable manner; and in a form that is readily intelligible to them; (c) (d) to be given reasons if a request made under subparagraphs (a) and (b) is de- nied, and to be able to challenge such denial; and to challenge data relating to them and, if the challenge is successful to have the data erased, rectified, completed or amended.
Accountability principle A data controller should be accountable for complying with measures which give ef- fect to the principles stated above.

5 10 157 Schedule 10 Privacy Bill Schedule 10 Consequential amendments Part 1 Amendments to Acts s 215 Accident Compensation Act 2001 (2001 No 49) In section 246(7), replace “section 103 of the Privacy Act 1993” with “section 181 of the Privacy Act 2018”.

In section 289(6)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 290(3), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 295(5), replace “Privacy Act 1993” with “Privacy Act 2018”.

Animal Products Act 1999 (1999 No 93) In section 161(2), replace “privacy principles 2 and 11 of the Privacy Act 1993” with “information privacy principles 2 and 11 set out in section 19 of the Priva- cy Act 2018”.

Animal Welfare Act 1999 (1999 No 142) In section 103(4), replace “Privacy Act 1993” with “Privacy Act 2018”.
Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (2009 No 35) In section 36(2) and (3), replace “privacy principles 5 to 11 in section 6 of the Privacy Act 1993” with “information privacy principles 5 to 11 set out in section 19 of the Privacy Act 2018”.

In section 139(3), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 146(1)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.
Auditor Regulation Act 2011 (2011 No 21) In section 46(3)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

Replace section 46(4) with: (4) A person who searches the register for personal information in breach of this section must be treated, for the purposes of Part 5 of the Privacy Act 2018, as having breached an information privacy principle under section 75(2)(a)(i) of that Act.

Biosecurity Act 1993 (1993 No 95) In section 41G(2), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 41I(2), replace “Privacy Act 1993” with “Privacy Act 2018”.

158 Privacy Bill Schedule 10 Births, Deaths, Marriages, and Relationships Registration Act 1995 (1995 No 16) In section 2, definition of approved information sharing agreement and informa- tion sharing agreement, replace “section 96C of the Privacy Act 1993” with “sec- tion 138 of the Privacy Act 2018”.
In section 2, definition of Privacy Commissioner, replace “section 12 of the Privacy Act 1993” with “section 10 of the Privacy Act 2018”.

In section 75E(1), replace “section 2 of the Privacy Act 1993” with “section 6 of the Privacy Act 2018”.

In section 78A(5), replace “section 97 of the Privacy Act 1993” with “section 177 of the Privacy Act 2018”.
Broadcasting Act 1989 (1989 No 25) In section 2(1), definition of individual, replace “section 2(1) of the Privacy Act 1993” with “section 6 of the Privacy Act 2018”.

In section 21(4), replace “Privacy Act 1993” with “Privacy Act 2018”.
Building Act 2004 (2004 No 72) Replace section 308 with: 308 When search constitutes interference with privacy of individual A search of the register for personal information that has not been carried out in accordance with sections 305 to 307 constitutes an action that is an interfer- ence with the privacy of an individual under section 75 of the Privacy Act 2018.
Charities Act 2005 (2005 No 39) Replace section 29 with: 29 When search constitutes interference with privacy of individual A search of the register for personal information that has not been carried out in accordance with sections 27 and 28 constitutes an action that is an interfer- ence with the privacy of an individual under section 75 of the Privacy Act 2018.
Child Protection (Child Sex Offender Government Agency Registration) Act 2016 (2016 No 42) In section 43(2)(g), replace “section 2 of the Privacy Act 1993” with “section 6 of the Privacy Act 2018” In section 43(3)(a), replace “section 111 of the Privacy Act 1993” with “section 172 of the Privacy Act 2018” Children’s Commissioner Act 2003 (2003 No 121) In section 22(2)(c), replace “Privacy Act 1993” with “Privacy Act 2018”.
159 Schedule 10 Privacy Bill Children’s Commissioner Act 2003 (2003 No 121)—continued In section 22(4), replace “sections 27 to 29 of the Privacy Act 1993” with “sections 52 to 57 of the Privacy Act 2018”.

Civil Aviation Act 1990 (1990 No 98) In section 10(7)(a)(i), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 10(7)(a)(ii), replace “section 27(1)(d)” with “section 52(1)(a)(i)”.

In section 19(7)(a)(i), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 19(7)(a)(ii), replace “section 27(1)(d)” with “section 52(1)(a)(i)”.

In section 74(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

5 Climate Change Response Act 2002 (2002 No 40) In section 52(1)(a)(ii), replace “principles of the Privacy Act 1993” with “information privacy principles set out in section 19 of the Privacy Act 2018”.

10 Companies Act 1993 (1993 No 105) In the heading to section 367, replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 367(2), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 371A(5), replace “Privacy Act 1993” with “Privacy Act 2018”.

Conservation Act 1987 (1987 No 65) In section 17U(1)(g), replace “Privacy Act 1993” with “Privacy Act 2018”.

Coroners Act 2006 (2006 No 38) In section 29(2)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

Corrections Act 2004 (2004 No 50) In section 110A(b)(i), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 110A(b)(iv), replace “section 54(1) of the Privacy Act 1993” with “sec- tion 27 of the Privacy Act 2018”.

In the heading to section 110C, replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 110C, replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 117(2)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 117(2)(c), replace “section 2(1) of the Privacy Act 1993” with “section 6 of the Privacy Act 2018”.
In section 117(2)(d), replace “section 54(1) of the Privacy Act 1993” with “section 27 of the Privacy Act 2018”.

In section 118(1), replace “Privacy Act 1993” with “Privacy Act 2018”.

In the heading to section 119, replace “Privacy Act 1993” with “Privacy Act 2018”.

15 20 25 30 160 Privacy Bill Schedule 10 Corrections Act 2004 (2004 No 50)—continued In section 119, replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 120(1)(a)(iv) and (2), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 180C(3), (4), and (5), replace “section 103(1) of the Privacy Act 1993” with “section 181 of the Privacy Act 2018”.

In section 181A(2), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 181A(4), definition of specified agency, paragraph (c), replace “section 2 of the Privacy Act 1993” with “section 6 of the Privacy Act 2018”.

In section 182A(2), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 182C, definition of specified agency, paragraph (f), replace “section 2 of the Privacy Act 1993” with “section 6 of the Privacy Act 2018”.

In section 182D(2)(c), replace “section 6 of the Privacy Act 1993” with “section 19 of the Privacy Act 2018”.

5 10 Criminal Disclosure Act 2008 (2008 No 38) In section 6(1), definition of publicly available publication, replace “section 2(1) of the Privacy Act 1993” with “section 6 of the Privacy Act 2018”.
15 Criminal Investigations (Bodily Samples) Act 1995 (1995 No 55) In section 24R(1)(b), replace “Privacy Act 1993” with “Privacy Act 2018”.

Replace section 24R(4) with: (4) Nothing in this section limits the jurisdiction of the Privacy Commissioner under the Privacy Act 2018 to investigate any complaint made under Part 5 of that Act.

In section 27(1)(b), replace “Privacy Act 1993” with “Privacy Act 2018”.
Replace section 27(3) with: (3) Nothing in this section limits the jurisdiction of the Privacy Commissioner under the Privacy Act 2018 to investigate any complaint made under Part 5 of that Act.

Criminal Procedure (Mentally Impaired Persons) Act 2003 (2003 No 115) In section 46(2), replace “Privacy Act 1993” with “Privacy Act 2018”.

Criminal Records (Clean Slate) Act 2004 (2004 No 36) In section 4, definition of law enforcement agency, replace “Privacy Act 1993” with “Privacy Act 2018”.
20 25 30 Crown Organisations (Criminal Liability) Act 2002 (2002 No 37) Replace section 10(1)(b)(iii) with: 161 Schedule 10 Privacy Bill Crown Organisations (Criminal Liability) Act 2002 (2002 No 37)—continued (iii) sections 91 and 92 of the Privacy Act 2018; or Crown Pastoral Land Act 1998 (1998 No 65) In section 51(2)(f), replace “Privacy Act 1993” with “Privacy Act 2018”.
Customs and Excise Act 1996 (1996 No 27) Replace section 133(2)(b) with: (b) overrides information privacy principle 12(2) set out in section 19 of the Privacy Act 2018.

In section 282A(2), replace “of the Privacy Act 1993” with “set out in section 19 of the Privacy Act 2018”.

In section 282A(3)(b), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 282J(2), replace “of the Privacy Act 1993” with “set out in section 19 of the Privacy Act 2018”.
In section 282L(2), replace “of the Privacy Act 1993” with “set out in section 19 of the Privacy Act 2018”.

In section 286A(2)(c)(v), replace “of the Privacy Act 1993” with “set out in section 19 of the Privacy Act 2018”.

District Court Act 2016 (2016 No 49) In section 236(3), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 237(2), (3) and (4), replace “Privacy Act 1993” with “Privacy Act 2018” in each place.
Dog Control Act 1996 (1996 No 13) In section 35(5)(f)(i), replace “section 63 of the Privacy Act 1993” with “section 36 of the Privacy Act 2018”.

Domestic Violence Act 1995 (1995 No 86) In section 107, definition of Privacy Commissioner, replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 107, definition of public register, replace “section 58 of the Privacy Act 1993” with “section 29 of the Privacy Act 2018”.
Replace section 120 with: 120 Application of certain provisions of Privacy Act 2018 Parts 5 and 9 of the Privacy Act 2018, so far as applicable and with all necessary modifications, apply in relation to the making of a complaint under section 118 and to any investigation conducted by the Privacy Commissioner in respect of that complaint.
162 Privacy Bill Schedule 10 Domestic Violence Act 1995 (1995 No 86)—continued In the heading to section 123, replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 123, replace “Sections 47 to 52 of the Privacy Act 1993” with “Sections 38 to 42 of the Privacy Act 2018”.

Education Act 1989 (1989 No 80) In section 18AA(1)(f), replace “Privacy Act 1993” with “Privacy Act 2018”.

In the heading to section 158X, replace “Privacy Act 1993” with “Privacy Act 2018”.
5 In section 158X, replace “sections 35 and 36 of the Privacy Act 1993” with “sec- tions 72 and 73 of the Privacy Act 2018”.

Electoral Act 1993 (1993 No 87) 10 In section 111A(b)(iii), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 111E(3)(c), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 204I(7), replace “Privacy Act 1993” with “Privacy Act 2018”.
Replace section 204X with: 204X When search constitutes interference with privacy of individual 15 A search of the register for personal information that has not been carried out for a purpose specified in section 204S constitutes an action that is an interfer- ence with the privacy of an individual under section 75 of the Privacy Act 2018.
Electricity Act 1992 (1992 No 122) Replace section 141 with: 141 When search constitutes interference with privacy of individual A search of the register for personal information that has not been carried out in accordance with sections 138 to 140 constitutes an action that is an interfer- ence with the privacy of an individual under section 75 of the Privacy Act 2018.
In section 141, replace “is an interference with the privacy of an individual under sec- tion 66 of the Privacy Act 1993” with “interferes with the privacy of an individual in respect of which a complaint may be made under section 75 of the Privacy Act 2018”.

Electricity Industry Act 2010 (2010 No 116) In section 134(3), replace “section 66 of the Privacy Act 1993” with “section 75 of the Privacy Act 2018”.

In Schedule 4, clause 17(2), replace “Privacy Act 1993” with “Privacy Act 2018”.
20 25 30 163 Schedule 10 Privacy Bill Electronic Identity Verification Act 2012 (2012 (No 123) In section 7, definition of personal information, replace “section 2 of the Privacy Act 1993” with “section 6 of the Privacy Act 2018”.

In section 7, definition of Privacy Commissioner, replace “section 12 of the Privacy Act 1993” with “section 10 of the Privacy Act 2018”.
Replace section 40(2) with: (2) This section applies despite rule 5 of the information matching rules set out in Schedule 7 of the Privacy Act 2018.

In the heading to section 59, replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 59(1), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 59(2), replace “principle 7(3) in section 6 of the PA” with “principle 7 set out in section 19 of the PA”.

In section 59(4), replace “in section 6” with “set out in section 19”.
In section 59(5), replace “in section 6 of the PA, as required by the precedence given to this Act by section 7(1) and (2) of the PA” with “set out in section 19 of the PA, as required by the precedence given to this Act by section 22(1) of the PA”.

In section 59(6), replace “Part 8, a person is taken to have breached an information privacy principle under its section 66(1)(a)(i)” with “Part 5, a person is taken to have breached an information privacy principle under its section 75(2)(a)(i)”.
In section 59(7), replace “Part 8” with “Part 5”.

In section 59(8), replace “section 58” with “section 29”.

In section 65(2), replace “Part 8 of the Privacy Act 1993” with “Part 5 of the Priva- cy Act 2018”.

Employment Relations Act 2000 (2000 No 24) Replace section 4(1C)(a)(ii) with: (ii) the Privacy Act 2018 (despite section 22(1) of that Act): In section 34(8), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 69G(2)(e)(ii), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 69OEA(7), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 233B(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

Energy Efficiency and Conservation Act 2000 (2000 No 14) In section 38(6), replace “Privacy Act 1993” with “Privacy Act 2018”.

5 10 15 20 25 30 Environmental Protection Authority Act 2011 (2011 No 14) In section 24(2), replace “section 66 of the Privacy Act 1993” with “section 75 of the Privacy Act 2018”.
35 164 Privacy Bill Schedule 10 Environmental Protection Authority Act 2011 (2011 No 14)—continued In section 30(2), replace “section 66 of the Privacy Act 1993” with “section 75 of the Privacy Act 2018”.

In section 45(5), replace “section 66 of the Privacy Act 1993” with “section 75 of the Privacy Act 2018”.

In section 50(5), replace “section 66 of the Privacy Act 1993” with “section 75 of the Privacy Act 2018”.
5 Fair Trading Act 1986 (1986 No 121) In section 48A(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

Financial Advisers Act 2008 (2008 No 91) In section 151(5)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

10 Financial Markets Authority Act 2011 (2011 No 5) In section 30(2), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 32(1)(b), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 33(3)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 44(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 54(1)(c), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 59(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 60(3)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

Replace section 66 with: 66 Part does not limit Privacy Act 2018 Nothing in this Part limits the Privacy Act 2018.

In section 72(2), replace “section 66 of the Privacy Act 1993” with “section 75 of the Privacy Act 2018”.
In section 78(3), replace “section 66 of the Privacy Act 1993” with “section 75 of the Privacy Act 2018”.

Financial Markets Conduct Act 2013 (2013 No 69) In Schedule 2, replace clause 12(4) with: (4) A person who searches the register for personal information in breach of this clause must be treated, for the purposes of Part 5 of the Privacy Act 2018, information privacy principle under section as having breached an 75(2)(a)(i) of that Act.
15 20 25 30 165 Schedule 10 Privacy Bill Financial Reporting Act 2013 (2013 No 101) In section 21, definitions of personal information and Privacy Commissioner, re- place “section 2(1) of the Privacy Act 1993” with “section 6 of the Privacy Act 2018”.

In section 23(1), replace “principle 10 or 11 of the Privacy Act 1993” with “informa- tion privacy principle 10 or 11 of the Privacy Act 2018”.
Financial Service Providers (Registration and Dispute Resolution) Act 2008 (2008 No 97) In section 32(a), replace “Privacy Act 1993” with “Privacy Act 2018”.
Replace section 33 with: 33 When search breaches information privacy principle A person who searches a public register for personal information for a purpose that is not a purpose set out in section 32 must be treated, for the purposes of Part 5 of the Privacy Act 2018, as if that person breached an information privacy principle under section 75(2)(a)(i) of that Act.

In section 67(1), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 69(2), replace “Privacy Act 1993” with “Privacy Act 2018”.
Financial Transactions Reporting Act 1996 (1996 No 9) In section 25(1)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

Replace the cross-heading above section 28 with: Application of Privacy Act 2018 Replace the heading to section 28 with “Application of Privacy Act 2018”.

In section 28, replace “Privacy Act 1993” with “Privacy Act 2018”.

Fire and Emergency New Zealand Act 2017 (2017 No 17) In section 97(3), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 98(3)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

In Schedule 1, clause 5(2), replace “section 66 of the Privacy Act 1993” with “sec- tion 75 of the Privacy Act 2018”.

In Schedule 1, clause 6(2), replace “section 66 of the Privacy Act 1993” with “sec- tion 75 of the Privacy Act 2018”.

In Schedule 1, clause 7(2), replace “section 66 of the Privacy Act 1993” with “sec- tion 75 of the Privacy Act 2018”.
Fisheries Act 1996 (1996 (No 88) In the heading to section 102, replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 102(1), replace “Privacy Act 1993” with “Privacy Act 2018”.

35 166 Privacy Bill Schedule 10 Fisheries Act 1996 (1996 (No 88)—continued In section 129(1), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 186M(1), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 296ZH(2), replace “Privacy Act 1993” with “Privacy Act 2018”.
Food Act 2014 (2014 No 32) In section 368(2)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 370(2)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

5 Gambling Act 2003 (2003 No 51) In section 233(c), replace “Privacy Act 1993” with “Privacy Act 2018”.

Game Animal Council Act 2013 (2013 No 98) In section 26(6)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.
10 Harmful Digital Communications Act (2015 No 63) In section 24(5), replace “privacy principle 11(e)(iv) in section 6 of the Privacy Act 1993” with “information privacy principle 11(e)(iv) set out in section 19 of the Privacy Act 2018”.

In section 24(7), replace “Privacy Act 1993” with “Privacy Act 2018”.

Replace the subpart heading above section 39 with: In section 39, replace “Privacy Act 1993” with “Privacy Act 2018”.
Subpart 4—Privacy Act 2018 Hazardous Substances and New Organisms Act 1996 (1996 No 30) In section 82C(6)(a)(i), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 82C(6)(a)(ii), replace “section 27(1)(d)” with “section 52(1)(a)(i)”.

In section 97C(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

Health Act 1956 (1956 No 65) In section 22B, definition of agency, replace “section 2 of the Privacy Act 1993” with “section 6 of the Privacy Act 2018”.
In section 22C(1)(b)(i), replace “section 46 of the Privacy Act 1993” with “section 35 of the Privacy Act 2018”.

In section 22C(1)(b)(ii), replace “section 6” with “section 19”.

In section 22C(3), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 22F(2)(c), replace “section 46 of the Privacy Act 1993” with “section 35 of the Privacy Act 2018”.
15 20 25 30 167 Schedule 10 Privacy Bill Health Act 1956 (1956 No 65)—continued In section 22F(3)(c), replace “section 6 of the Privacy Act 1993” with “section 19 of the Privacy Act 2018”.

In section 22F(4), replace “Part 8 of the Privacy Act 1993” with “Part 5 of the Pri- vacy Act 2018”.

In section 92I(9), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 92J(9), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 92K(9), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 92U, replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 92ZS, replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 92ZZF(3) and (4), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 92ZZG, replace “Privacy Act 1993” with “Privacy Act 2018”.
Health and Disability Commissioner Act 1994 (1994 No 88) Replace section 20(1)(c)(i) with: (i) matters of privacy (other than matters that may be the subject of a complaint under Part 5 of the Privacy Act 2018 or matters to which subpart 4 of Part 7 of that Act relates): Health and Safety at Work Act (2015 No 70) In section 16, definition of personal information, replace “section 2(1) of the Priva- cy Act 1993” with “section 6 of the Privacy Act 2018”.
In section 197(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 199(3), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 210(3), replace “Privacy Act 1993” with “Privacy Act 2018”.

Health Practitioners Competence Assurance Act 2003 (2003 No 48) In section 44(2), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 78(3), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 154(a), replace “Privacy Act 1993” with “Privacy Act 2018”.
Housing Corporation Act 1974 (1974 No 19) In section 50O(2), replace “Privacy Act 1993” with “Privacy Act 2018”.

In the heading to section 60, replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 60, replace “Privacy Act 1993” with “Privacy Act 2018”.

Housing Restructuring and Tenancy Matters Act 1992 (1992 No 76) In section 79(2), replace “section 7(1) of the Privacy Act 1993” with “section 22 of the Privacy Act 2018”.
168 Privacy Bill Schedule 10 Housing Restructuring and Tenancy Matters Act 1992 (1992 No 76)—continued In section 80(5), replace “section 7(1) of the Privacy Act 1993” with “section 22 of the Privacy Act 2018”.

In section 86(4), replace “Part 6 of the Privacy Act 1993” with “section 35 of the Privacy Act 2018”.

In section 88(2), replace “Part 6 of the Privacy Act 1993” with “section 35 of the Privacy Act 2018”.
Replace section 89(2) with: (2) Part 5 of the Privacy Act 2018 applies to any such complaint as if the code of conduct were a code of practice issued under section 35 of that Act.

In section 124(2), replace “section 7(1) of the Privacy Act 1993” with “section 22 of the Privacy Act 2018”.

In section 125(5), replace “section 7(1) of the Privacy Act 1993” with “section 22 of the Privacy Act 2018”.

In section 138(4), replace “Part 6 of the Privacy Act 1993” with “section 35 of the Privacy Act 2018”.
In section 140, replace “Part 6 of the Privacy Act 1993” with “section 35 of the Privacy Act 2018”.

Replace section 141(2) with: 5 10 15 (2) Part 5 of the Privacy Act 2018 applies to the complaint as if the code of conduct were a code of practice issued under section 35 of that Act.

20 Human Assisted Reproductive Technology Act 2004 (2004 No 92) Replace the cross-heading above section 66 with: Application of Privacy Act 2018 Replace the heading to section 66 with “Application of Privacy Act 2018”.
In section 66(1), replace “section 12 of the Privacy Act 1993” with “section 10 of the Privacy Act 2018”.

In section 66(2), replace “Sections 40 and 41 of the Privacy Act 1993” with “Sec- tions 49, 50 and 51 of the Privacy Act 2018”.
Replace section 66(3) and (4) with: (3) Parts 5 and 9 of the Privacy Act 2018, so far as applicable and with any necessary modifications, apply to the making of a complaint under subsection (1) as if the matter to which the complaint relates were an interference with the privacy of an individual under section 75 of that Act.

(4) Nothing in this section limits the jurisdiction of the Privacy Commissioner under the Privacy Act 2018 to investigate any complaint made under Part 5 of that Act.
25 30 35 169 Schedule 10 Privacy Bill Human Rights Act 1993 (1993 No 82) In section 148A(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

Human Tissue Act 2008 (2008 No 28) In section 78(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 86(3), replace “section 46 of the Privacy Act 1993” with “section 35 of the Privacy Act 2018”.
5 Identity Information Confirmation Act 2012 (2012 No 124) In section 5, definition of Privacy Commissioner, replace “section 12 of the Privacy Act 1993” with “section 10 of the Privacy Act 2018”.

Replace section 21(1)(d) with: 10 (d) the Privacy Act 2018.

Immigration Act 1987 (1987 No 74) In section 141ABA(5), replace “Privacy Act 1993” with “Privacy Act 2018” Immigration Act 2009 (2009 No 51) In section 11(1)(c)(ia), replace “section 6 of the Privacy Act 1993” with “section 19 of the Privacy Act 2018”.
In section 31(2), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 35(2)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 151(3)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 177(4)(ab), replace “privacy” with “information privacy”.

In section 177(4)(ab), replace “section 6 of the Privacy Act 1993” with “section 19 of the Privacy Act 2018”.

In section 229(2), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 304(5), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 463(1A), replace “section 6 of the Privacy Act 1993” with “section 19 of the Privacy Act 2018”.

Income Tax Act 2007 (2007 No 97) In section BH 1(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

Insolvency Act 2006 (2006 No 55) In section 153(2), replace “Privacy Act 1993” with “Privacy Act 2018”.
Replace section 456 with: 456 When search breaches information privacy principle A person who searches a public register for a purpose that is not a purpose set out in section 454 must be treated, for the purposes of Part 5 of the Privacy 15 20 25 30 170 Privacy Bill Schedule 10 Insolvency Act 2006 (2006 No 55)—continued Act 2018, as if that person has breached in information privacy principle under section 75 of that Act.
Insurance (Prudential Supervision) Act 2010 (2010 No 111) In section 227(4), replace “section 66 of the Privacy Act 1993” with “section 75 of the Privacy Act 2018”.

5 Intelligence and Security Act 2017 (2017 No 10) In section 4, definition of Privacy Commissioner, replace “section 12 of the Privacy Act 1993” with “section 10 of the Privacy Act 2018”.

In section 119(b), replace “in section 6 of the Privacy Act 1993” with “set out in sec- tion 19 of the Privacy Act 2018”.
In section 122(3), replace “section 6 of the Privacy Act 1993” with “section 19 of the Privacy Act 2018”.

In section 220(2), replace “in section 6 of the Privacy Act 1993” with “set out in sec- tion 19 of the Privacy Act 2018”.
10 Judicial Conduct Commissioner and Judicial Conduct Panel Act 2004 (2004 No 38) 15 Replace section 19(3) with: (3) Nothing in information privacy principle 6 set out in section 19 of the Privacy Act 2018 (access to personal information) applies in respect of any information held by the office of the Commissioner that relates to any investi- gation conducted by the Commissioner under this Act, other than any docu- ment (as defined in section 6 of the Privacy Act 2018) that comes into ex- istence before the commencement of that investigation.
KiwiSaver Act 2006 (2006 No 40) In section 4(1), definition of personal information, replace “Privacy Act 1993” with “Privacy Act 2018”.

Replace section 41(g) with: (g) a statement about collection of personal information that complies with information privacy principle 3 set out in section 19 of the Priva- cy Act 2018; and In section 158(3)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 207(2), replace “Information Privacy Principle 12(2) or (4) of the Privacy Act 1993” with “information privacy principle 12(2) or (6) set out in section 19 of the Privacy Act 2018”.

Land Transport Act 1998 (1998 No 110) In section 30I(2)(a)(i), replace “Privacy Act 1993” with “Privacy Act 2018”.

20 25 30 35 171 Schedule 10 Privacy Bill Land Transport Act 1998 (1998 No 110)—continued In section 30I(2)(a)(ii), replace “section 27(1)(d)” with “section 52(1)(a)(i)”.
Replace section 200(1A)(c) with: (c) subpart 2 of Part 7 of the Privacy Act 2018.

In section 211(2), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 211(3), replace “section 35 of the Privacy Act 1993” with “section 72 of the Privacy Act 2018”.

In section 237(4)(a)(ii), replace “Privacy Act 1993” with “Privacy Act 2018”.
Land Transport Management Act 2003 (2003 No 118) In section 5(1), definition of personal information, replace “section 2(1) of the Pri- vacy Act 1993” with “section 6 of the Privacy Act 2018”.

In section 46(3)(f), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 50(4), replace “principle 11 in the Privacy Act 1993” with “information privacy principle 11 set out in section 19 of the Privacy Act 2018”.
Limited Partnership Act 2008 (2008 No 1) Replace section 66 with: 66 When search breaches information privacy principle A person who searches a register for a purpose that is not a purpose set out in section 65 must be treated, for the purposes of Part 5 of the Privacy Act 2018, as if that person has breached an information privacy principle under section 75(2)(a)(i) of that Act.

Local Government Act 2002 (2002 No 84) In section 258Z(1), replace “Privacy Act 1993” with “Privacy Act 2018”.
In Schedule 7, clause 11(3), replace “Privacy Act 1993” with “Privacy Act 2018”.

5 10 15 20 Local Government (Auckland Council) Act 2009 (2009 No 32) In section 87(1)(b), replace “Privacy Act 1993” with “Privacy Act 2018”.

25 Local Government Official Information and Meetings Act 1987 (1987 No 174) In section 2(1), definition of official information, paragraph (c), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 10(1A), replace “subclause (1)(b) of principle 6 of the Privacy Act 1993” with “information privacy principle 6(1)(b) set out in section 19 of the Priva- cy Act 2018”.

In section 29A, replace “Privacy Act 1993” with “Privacy Act 2018”.

30 172 Privacy Bill Schedule 10 Local Government (Rating) Act 2002 (2002 No 6) In section 27(6)(c), replace “section 63 of the Privacy Act 1993” with “section 36 of the Privacy Act 2018”.
Māori Purpose (Wi Pere Trust) Act 1991 (1991 No 38) In Schedule 1, clause 9.8, replace “Privacy Act 1993” with “Privacy Act 2018”.

5 Marine and Coastal Area (Takutai Moana) Act 2011 (2011 No 3) Replace section 117 with: 117 Application of the Privacy Act 2018 The register is a public register within the meaning of section 29 of the Pri- vacy Act 2018.

10 Maritime Transport Act 1994 (1994 No 104) In section 49(7)(a)(i), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 49(7)(a)(ii), replace “section 27(1)(d)” with “section 52(1)(a)(i)”.

In section 50(7)(a)(i), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 50(7)(a)(ii), replace “section 27(1)(d)” with “section 52(1)(a)(i)”.

In section 189(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 276(7)(a)(i), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 276(7)(a)(ii), replace “section 27(1)(d)” with “section 52(1)(a)(i)”.
Motor Vehicle Sales Act 2003 (2003 No 12) Replace section 59 with: 59 When search constitutes interference with privacy of individual A search of the register for personal information that has not been carried out in accordance with sections 56 to 58 constitutes an action that is an interference with the privacy of an individual under section 75 of the Privacy Act 2018 .
Replace section 81 with: 81 When search constitutes interference with privacy of individual A search of the list for personal information that has not been carried out in accordance with sections 78 to 80 constitutes an action that is an interference with the privacy of an individual under section 75 of the Privacy Act 2018.

In section 129(c), replace “Privacy Act 1993” with “Privacy Act 2018”.
15 20 25 30 173 Schedule 10 Privacy Bill National Animal Identification and Tracing Act 2012 (2012 No 2) In section 4, definition of personal information, replace “section 2(1) of the Privacy Act 1993” with “section 6 of the Privacy Act 2018”.

In Schedule 2, clause 55(3)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

In Schedule 2, clause 78(3)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.
National Bank of New Zealand Limited Act 1994 (1994 No 3) In section 5(3)(b)(ii), replace “Privacy Act 1993” with “Privacy Act 2018”.

New Zealand Public Health and Disability Act 2000 (2000 No 91) In section 23(3), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 30(6), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 79(6), replace “Privacy Act 1993” with “Privacy Act 2018”.
In Schedule 3, clause 21(5)(a), replace “subclause (1)(b) of principle 6 of the Privacy Act 1993” with “information privacy principle 6(1)(b) set out in section 19 of the Privacy Act 2018”.

In Schedule 3, clause 32, replace “Part 8 of the Privacy Act 1993” with “Part 5 of the Privacy Act 2018”.

In Schedule 4, clause 23(5)(a), replace “subclause (1)(b) of principle 6 of the Privacy Act 1993” with “information privacy principle 6(1)(b) set out in section 19 of the Privacy Act 2018”.
In Schedule 4, clause 34(d), replace “Part 8 of the Privacy Act 1993” with “Part 5 of the Privacy Act 2018”.

In Schedule 5, clause 3(a), replace “section 2(1) of the Privacy Act 1993” with “sec- tion 6 of the Privacy Act 2018”.

Official Information Act 1982 (1982 No 156) In section 2(1), definition of official information, paragraph (j), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 12(1A), replace “subclause (1)(b) of principle 6 of the Privacy Act 1993” with “information privacy principle 6(1)(b) set out in section 19 of the Priva- cy Act 2018”.

In section 29B, replace “Privacy Act 1993” with “Privacy Act 2018”.

Ombudsman Act 1975 (1975 No 9) In section 17A(1) and (3), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 21A, replace “Privacy Act 1993” with “Privacy Act 2018”.
174 Privacy Bill Schedule 10 Outer Space and High-altitude Activities Act 2017 (2017 No 29) In section 85(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

Parole Act 2002 (2002 No 10) In section 13(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 13AC(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 13AD(2), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 15A(2), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 108(3), replace “Privacy Act 1993” with “Privacy Act 2018”.

Personal Property Securities Act 1999 (1999 No 126) In section 16(1), definition of personal information, replace “section 2(1) of the Pri- vacy Act 1993” with “section 6 of the Privacy Act 2018”.

In section 173(a), replace “Privacy Act 1993” with “Privacy Act 2018”.
Replace section 174 with: 174 When search constitutes interference with privacy of individual A search of the register for personal information that has not been carried out in accordance with sections 171 to 173 constitutes an action that is an interfer- ence with the privacy of an individual under section 75 of the Privacy Act 2018.
Plumbers, Gasfitters, and Drainlayers Act 2006 (2006 No 74) Replace section 87 with: 87 When search constitutes interference with privacy of individual A search of the register for personal information that has not been carried out in accordance with sections 84 to 86 constitutes an action that is an interference with the privacy of an individual under section 75 of the Privacy Act 2018.

Policing Act 2008 (2008 No 72) In the heading to section 57, replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 57, replace “Nothing in principles 2, 3, and 10 of the Privacy Act 1993” with “Nothing in information privacy principles 2, 3, and 10 set out in sec- tion 19 of the Privacy Act 2018”.

Replace section 95B(6) with: (6) A person who contravenes a provision of this section must be treated, for the purposes of Part 5 of the Privacy Act 2018, as having breached an infor- mation privacy principle under section 75(2)(a)(i) of that Act.
175 Schedule 10 Privacy Bill Prisoners’ and Victims’ Claims Act 2005 (2005 No 74) In section 3(2A)(b), replace “Privacy Act 1993” with “Privacy Act 2018”.

Replace section 6(2), definition of a breach of, or interference with, a specified right, paragraph (c),with: (c) an interference with the privacy of an individual (within the meaning of section 75 of the Privacy Act 2018) 5 Public Audit Act 2001 (2001 No 10) In section 25(2)(c), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 30(4), replace “of the Privacy Act 1993” with “set out in section 19 of the Privacy Act 2018”.

10 Public Records Act 2005 (2005 No 40) In section 25(1)(c) and (2)(e), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 44(8), replace “Privacy Act 1993” with “Privacy Act 2018”.

Public Safety (Public Protection Orders) Act 2014 (2014 No 68) In section 56(2)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 56(2)(d), replace “section 54(1) of the Privacy Act 1993” with “section 27 of the Privacy Act 2018”.

In section 57(1), replace “Privacy Act 1993” with “Privacy Act 2018”.

Replace section 58 with: 58 Application of Privacy Act 2018 The Privacy Act 2018 applies to the monitoring of resident calls under sec- tion 51 to 61.

In section 59(1)(b)(iv), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 59(2), replace “Privacy Act 1993” with “Privacy Act 2018”.
Radiation Safety Act 2016 (2016 No 6) In section 34(1)(d), replace “section 54(1) of the Privacy Act 1993” with “section 27 of the Privacy Act 2018”.
15 20 25 Real Estate Agents Act 2008 (2008 No 66) Replace section 70 with: 70 When search constitutes interference with privacy of individual 30 A person who searches the register for a purpose that is not a purpose set out in section 64 must be treated, for the purposes of Part 5 of the Privacy Act 2018, as having breached an information privacy principle under section 75(2)(a)(i) of that Act.
176 Privacy Bill Schedule 10 Real Estate Agents Act 2008 (2008 No 66)—continued In section 86(3), replace “Privacy Act 1993” with “Privacy Act 2018”.

Residential Tenancies Act 1986 (1986 No 120) In section 66O(2)(b)(ii), replace “Privacy Act 1993” with “Privacy Act 2018”.

Search and Surveillance Act 2012 (2012 No 24) In section 5(b), replace “Privacy Act 1993” with “Privacy Act 2018”.

5 Senior Courts Act 2016 (2016 No 48) In section 173(3), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 174(2), (3), and (4), replace “Privacy Act 1993” with “Privacy Act 2018”.

Sentencing Act 2002 (2002 No 9) In section 29(2), replace “Privacy Act 1993” with “Privacy Act 2018”.

Social Security Act 1964 (1964 No 136) In section 11A(6), replace “sections 100 to 102 and 104 to 106 of the Privacy Act 1993” with “sections 179, 180, and 182 to 184 of the Privacy Act 2018”.

In section 11A(6), replace “Schedule 4” with “Schedule 7”.

In section 11A(6), replace “rule 4” with “rule 3”.


Replace section 11A(7) with: (7) If the chief executive fails to comply, in relation to an individual, with subsec- tion (4) or with any of the provisions of the sections or rules applied by subsec- tion (6), that failure is to be treated as an interference with the privacy of the individual under section 75(2)(a)(iii) of the Privacy Act 2018, in respect of which a complaint may be made under Part 5 of that Act.
In section 11A(8), replace “section 97 of the Privacy Act 1993” with “section 177 of the Privacy Act 2018”.

In section 11A(9), replace “section 103(1A) of the Privacy Act 1993” with “section 181(2) of the Privacy Act 2018”.

In section 11B(1), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 11B(4) and (5), replace “Part 6 of the Privacy Act 1993” with “Part 3 of the Privacy Act 2018”.
Replace section 11B(7) with: (7) Part 5 of the Privacy Act 2018 applies to any such complaint as if the code of conduct were a code of practice issued under Part 3 of that Act.

In section 75B(4), replace “section 103(1) of the Privacy Act 1993” with “section 181(1) of the Privacy Act 2018”.

10 15 20 25 30 177 Schedule 10 Privacy Bill Social Security Act 1964 (1964 No 136)—continued In section 123F(1), replace “Part 9A of the Privacy Act 1993” with “subpart 1 of Part 7 of the Privacy Act 2018”.
In section 125C(4), replace “section 96O of the Privacy Act 1993” with “section 150 of the Privacy Act 2018”.

In section 125D(5), replace “section 96O of the Privacy Act” with “section 150 of the Privacy Act 2018”.

In section 125D(7), replace “section 2(1) of the Privacy Act 1993” with “section 6 of the Privacy Act 2018”.
Replace section 125I(3) with: (3) Part 5 of the Privacy Act 2018— (a) applies to a complaint under subsection (1) as if the regulations con- cerned and section 125D together constituted a code of practice issued under Part 3 of that Act; and applies to a complaint under subsection (2) as if the information sharing agreement concerned were a code of practice issued under Part 3 of that Act.
(b) Social Welfare (Reciprocity Agreements, and New Zealand Artificial Limb Service) Act 1990 (1990 No 26) In section 2(1), definition of Privacy Commissioner, replace “Privacy Act 1993” with “Privacy Act 2018”.
Replace section 19(2A)(a) with: (a) whether the provision complies with the information privacy principles in section 18 of the Privacy Act 2018: In section 19D(3)(e), replace “sections 100 to 102 and 104 to 106 of the Privacy Act 1993” with “sections 179, 180, and 182 to 184 of the Privacy Act 2018”.
Replace section 19D(5) with: (5) Any regulations made under the Privacy Act 2018 relating to the giving of a notice under section 181 of that Act apply to any notice to be given to any individual under subsection (3)(c) or (4B).
Replace section 19D(6) with: (6) If the chief executive fails to comply, in relation to an individual, with subsec- tion (3)(c), that failure is to be treated as an interference with the privacy of the individual under section 75(2)(a)(iii) of the Privacy Act 2018, in respect of which a complaint may be made under Part 5 of that Act.

In section 19D(7), replace “section 97 of the Privacy Act 1993” with “section 177 of the Privacy Act 2018”.
35 178 Privacy Bill Schedule 10 Social Workers Registration Act 2003 (2003 No 17) In section 46(2), replace “Privacy Act 1993” with “Privacy Act 2018”.

Summary Proceedings Act 1957 (1957 No 87) In section 92A(1), definition of agency, replace “section 2(1) of the Privacy Act 1993” with “section 6 of the Privacy Act 2018”.

In section 92A(1), definition of credit reporting code of practice, replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 92A(1), definition of fines enforcement records, replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 92F(1)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

Replace section 92F(3) with: (3) A person who contravenes this section or who discloses or uses information in contravention of any regulations made under section 92I must be treated as having breached an information privacy principle under section 75(2)(a)(i) of the Privacy Act 2018.
In section 92G(2) and (3), replace “section 103 of the Privacy Act 1993” with “sec- tion 181 of the Privacy Act 2018”.

Takeovers Act 1993 (1993 No 107) In section 15A(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 15B(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 15C(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 31E(c), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 31R(2)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

Tax Administration Act 1994 (1994 No 166) In section 46A(4), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 81(4)(nb), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 81A, replace “section 96J of the Privacy Act 1993” with “section 145 of the Privacy Act 2018”.

In seciton 81A, replace “section 96J” with “section 145”.

In section 81A, replace “Privacy Act 1993” with “Privacy Act 2018” in each place.
In section 81BA(6), replace “Privacy Act 1993” with “Privacy Act 2018”.

Te Urewera Act 2014 (2014 No 51) In section 14(g), replace “Privacy Act 1993” with “Privacy Act 2018”.

5 10 15 20 25 30 179 Schedule 10 Privacy Bill Telecommunications Act 2001 (2001 No 103) In section 100C(1)(c), replace “section 66 of the Privacy Act 1993” with “section 75 of the Privacy Act 2018”.

In Schedule 3C, clause 15, replace “Privacy Act 1993” with “Privacy Act 2018”.
Trans-Tasman Mutual Recognition Act 1997 (1997 No 60) In section 33(1)(b)(ii), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 34, replace “Privacy Act 1993” with “Privacy Act 2018”.

Transport Accident Investigation Commission Act 1990 (1990 No 99) In the heading to section 14Q, replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 14Q(1), replace “principle 6 of the Privacy Act 1993” with “information privacy principle 6 set out in section 19 of the Privacy Act 2018”.
In section 14Q(4), replace “sections 27 to 29 of the Privacy Act 1993” with “sec- tions 52 to 57 of the Privacy Act 2018”.

Veterinarians Act 2005 (2005 No 126) In section 42(3), replace “Privacy Act 1993” with “Privacy Act 2018”.

Victims Rights Act 2002 (2002 No 39) In the heading to section 15, replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 15(1) and (2), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 23(4), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 49(2)(d), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 50(3), replace “section 2(1) of the Privacy Act 1993” with “section 6 of the Privacy Act 2018”.

5 10 15 20 Waikato Raupatu Claims Settlement Act 1995 (1995 No 58) In Schedule 4, clause 2(2)(b)(ii), replace “Privacy Act 1993” with “Privacy Act 2018”.

25 Westpac New Zealand Act 2006 (2006 No 3) In section 20(4)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.
In section 21(a)(iii), replace “Privacy Act 1993” with “Privacy Act 2018”.

Westpac New Zealand Act 2011 (2011 No 1) In section 24(4)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

In section 25(a)(iii), replace “Privacy Act 1993” with “Privacy Act 2018”.

30 180 Privacy Bill Schedule 10 WorkSafe New Zealand Act 2013 (2013 No 94) In section 17(4), replace “section 66 of the Privacy Act 1993” with “section 75 of the Privacy Act 2018”.
Part 2 Amendments to legislative instruments 5 Chartered Professional Engineers of New Zealand Rules (No 2) 2002 (SR 2002/389) In rule 42(2), replace “Privacy Act 1993” with “Privacy Act 2018”.

Companies Act 1955 Liquidation Regulations 1994 (SR 1994/129) In the Schedule, forms 1 and 2, replace “Privacy Act 1993” with “Privacy Act 2018” in each place.
10 Companies Act 1993 Liquidation Regulations 1994 (SR 1994/130) In the Schedule, forms 1 and 2, replace “Privacy Act 1993” with “Privacy Act 2018” in each place.

Criminal Investigations (Bodily Samples) Regulations 2004 (SR 2004/53) 15 In the Schedule, forms 5A, 5B, 6, 8, 8A, 9, and 9A, replace “Privacy Act 1993” with “Privacy Act 2018”.

Customs and Excise Regulations 1996 (SR 1996/232) In Schedule 2, forms 3A, 4A, 5A, 6, and 10, replace “Privacy Act 1993” with “Priva- cy Act 2018”.
20 Double Taxation Relief (Poland) Order 2006 (SR 2006/169) In clause 3(1), replace “Privacy Act 1993” with “Privacy Act 2018”.

Double Taxation Relief (Spain) Order 2006 (SR 2006/170) In clause 3(1), replace “Privacy Act 1993” with “Privacy Act 2018”.

Education (Pastoral Care of International Students) Code of Practice 2016 (LI 2016/57) 25 In clause 25(1)(c), replace “Privacy Act 1993” with “Privacy Act 2018”.
Education (Stand-Down, Suspension, Exclusion, and Expulsion) Rules 1999 (SR 1999/202) In rules 15(2)(c) and 20(2)(c), replace “Privacy Act 1993” with “Privacy Act 2018”.

30 181 Schedule 10 Privacy Bill Financial Markets Conduct Regulations 2014 (LI 2014/326) In regulation 30(8)(m), replace “Part 1 of Schedule 2 of the Privacy Act 1993” with “Schedule 2 of the Privacy Act 2018”.
Fisheries (Foreign Fishing Vessel) Regulations 2001 (SR 2001/258) In Schedule 1, form 1, paragraph 14, replace “Privacy Act 1993” with “Privacy Act 2018”.
5 Health and Disability Commissioner (Code of Health and Disability Services Consumers’ Rights) Regulations 1996 (SR 1996/78) In the Schedule, clause 4, replace the definition of privacy with: privacy means all matters of privacy in respect of a consumer, other than mat- ters of privacy that may be the subject of a complaint under Part 5 of the Pri- vacy Act 2018 or matters to which subpart 4 of Part 7 of that Act relates 10 Health and Safety at Work (General Risk and Workplace Management) Regulations 2016 (LI 2016/13) In regulation 52(2), replace “section 97 of the Privacy Act 1993” with “section 177 of the Privacy Act 2018”.
15 Health and Safety at Work (Hazardous Substances) Regulations 2017 (LI 2017/131) In regulations 6.7(5)(b), 6.18(5)(a)(i), 6.26(4)(a), 6.31(5)(a)(i), 7.6(a)(i), and 7.13(5)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

In regulations 6.26(4)(d)(iv) and 7.13(5)(b)(iii), replace “section 54(1) of the Privacy Act 1993” with “section 27 of the Privacy Act 2018”.
Human Rights Review Tribunal Regulations 2002 (SR 2002/19) In regulation 3(1), definition of Privacy Commissioner, replace “section 12 of the Privacy Act 1993” with “section 10 of the Privacy Act 2018”.

In regulation 3(1), definition of proceedings, replace paragraph (a)(ii) with: (ii) section 102 or 103 of the Privacy Act 2018; or In regulation 6, table, first column, replace “section 82 of the Privacy Act 1993” with “section 102 of the Privacy Act 2018”.
In regulation 6, table, first column, replace “section 83 of the Privacy Act 1993” with “section 103 of the Privacy Act 2018”.

In the heading to regulation 10, replace “section 82 or section 83 of the Privacy Act 1993” with “section 102 or 103 of the Privacy Act 2018”.

In regulation 10, replace “section 82 or section 83 of the Privacy Act 1993” with “section 102 or 103 of the Privacy Act 2018”.

In regulation 10(a), replace “section 82” with “section 102”.
20 25 30 35 182 Privacy Bill Schedule 10 Human Rights Review Tribunal Regulations 2002 (SR 2002/19)—continued In regulation 10(b), replace “section 83” with “section 103”.

In regulation 14, table, first column, replace “section 83 of the Privacy Act 1993” with “section 103 of the Privacy Act 2018”.

In regulation 15(2), replace “(set out in section 6) of the Privacy Act 1993” with “(set out in section 19) of the Privacy Act 2018”.

In regulation 16(1)(b), replace “Privacy Act 1993” with “Privacy Act 2018”.
Replace regulation 16(3)(b) with: (b) section 102 or 103 of the Privacy Act 2018: In regulation 17(2), replace “section 86 of the Privacy Act 1993” with “section 104 of the Privacy Act 2018”.

In regulation 18(2)(d), replace “section 83 of the Privacy Act 1993” with “section 103 of the Privacy Act 2018”.

In regulation 21(1)(e), replace “section 82 of the Privacy Act 1993” with “section 102 of the Privacy Act 2018”.
In regulation 21(1)(f), replace “section 83 of the Privacy Act 1993” with “section 103 of the Privacy Act 2018”.

5 10 15 Lake Taupo (Crown Facilities, Permits and Fees) Regulations 2004 (SR 2004/140) In Schedule 2, replace “Privacy Act 1993” with “Privacy Act 2018” in each place.

Land Transport (Motor Vehicle Registration and Licensing) Regulations 2011 (SR 2011/79) 20 In regulation 57(k), replace “Privacy Act 1993” with “Privacy Act 2018”.
Lawyers and Conveyancers Act (Lawyers: Conduct and Client Care) Rules 2008 (SR 2008/214) In the Schedule, footnote 6, replace “Privacy Act 1993” with “Privacy Act 2018”.

25 Privacy (Information Sharing Agreement between Inland Revenue and Internal Affairs) Order 2014 (LI 2014/223) In clause 3(1), definition of Act, replace “Privacy Act 1993” with “Privacy Act 2018”.

In clause 3(2), replace “Part 9A” with “subpart 1 of Part 7”.
Replace clause 12(2) with: 30 (2) The agreement provides that Inland Revenue will (in accordance with section 153 of the Act) not provide notice of an adverse action under section 152 of the Act.

183 Schedule 10 Privacy Bill Privacy (Information Sharing Agreement between Inland Revenue and Ministry of Social Development) Order 2017 (LI 2017/176) In clause 3(1), definition of Act, replace “Privacy Act 1993” with “Privacy Act 2018”.
In clause 3(1), definition of information privacy principle, replace “in section 6” with “set out in section 19”.

In clause 3(1), definition of personal information, replace “section 2(1)” with “sec- tion 6”.

In clause 3(2), replace “Part 9A” with “subpart 1 of Part 7”.

In clause 13(1)(a), replace “section 96R(a)(ii)) not give notice (under section 96Q” with “section 153(a)(ii) not give notice (under section 152”.
In clause 13(1)(b), replace “section 96R(a)(ii)) dispense with the giving of notice (under section 96Q” with “section 153(a)(ii)) dispense with the giving of notice under section 152”.

Privacy (Information Sharing Agreement Between Inland Revenue and New Zealand Police) Order 2014 (LI 2014/184) In clause 3(1), definition of Act, replace “Privacy Act 1993” with “Privacy Act 2018”.

In clause 3(1), definition of personal information, replace “section 2(1)” with “sec- tion 6”.
In clause 3(2), replace “Part 9A” with “subpart 1 of Part 7”.

In clause 4, replace “Part 9A of the Privacy Act 1993” with “subpart 1 of Part 7 of the Privacy Act 2018”.

In clause 12, replace “section 96Q” with “section 152”.

Privacy (Information Sharing Agreement between Ministry of Justice and Crown Law Office) Order 2017 (LI 2017/218) In clause 3, definition of Act, replace “Privacy Act 1993” with “Privacy Act 2018”.
In clause 3, definition of personal information, replace “section 2(1)” with “sec- tion 6”.

Privacy Information Sharing Between Ministry of Justice and Statistics New Zealand) Order 2017 (LI 2017/51) In clause 3(1), definition of Act, replace “Privacy Act 1993” with “Privacy Act 2018”.

In clause 3, definition of personal information, replace “section 2(1)” with “sec- tion 6”.
184 Privacy Bill Schedule 10 Privacy (Information Sharing Agreement for Improving Public Services for Vulnerable Children) Order 2015 (LI 2015/162) In clause 3(1), definition of Act, replace “Privacy Act 1993” with “Privacy Act 2018”.

In clause 3(1), definition of agency, replace “section 2(1)” with “section 6”.

In clause 3(1), definition of Health Information Privacy Code, replace “section 46” with “section 35”.
In clause 3(1), definition of information privacy principle, replace “in section 6” with “set out in section 19”.

In clause 3(1), definition of personal information, replace “section 2(1)” with “sec- tion 6”.

In clause 3(3), replace “Part 9A” with “subpart 1 of Part 7”.

In clause 14(2), replace “section 96R(a)(ii) of the Act) not provide notice of adverse action under section 96Q” with “section 153(a)(ii) of the Act) not provide notice of adverse action under section 152”.
5 10 15 Private Security Personnel and Private Investigators (Code of Conduct— Surveillance of Individuals) Regulations 2011 (SR 2011/72) In regulation 5(2)(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

Real Estate Agents Act (Professional Conduct and Client Care) Rules 2012 (SR 2012/413) 20 In rule 9.17(d), replace “in section 6 of the Privacy Act 1993” with “set out in sec- tion 19 of the Privacy Act 2018”.
Registered Architects Rules 2006 (SR 2006/161) In rule 45(2), replace “Privacy Act 1993” with “Privacy Act 2018”.

Social Security (Contracts and Information Sharing with Service Providers) Regulations 2012 (SR 2012/210) 25 In regulation 12(a), replace “Privacy Act 1993” with “Privacy Act 2018”.

Social Security (Youth Support—Authorised Agencies) Order 2012 (SR 2012/209) In clause 3(1), definition of agency, replace “section 2(1) of the Privacy Act 1993” with “section 6 of the Privacy Act 2018”.
30 Summary Proceedings (Credit Reporting of Fines) Regulations 2011 (SR 2011/399) In regulation 5(2), replace “Privacy Act 1993” with “Privacy Act 2018” in each place.

35 185 Privacy Bill Wellington, New Zealand: Published under the authority of the New Zealand Government—2018 186